Consider the following search:
(index=_internal log group=tcpin connections) earliest
| stats count as _count by sourceHost guid fwdType version
| eventstats dc(sourceHost) as dc_sourceHost by guid
| where dc_sourceHost > 1
| fields - dc_sourceHost
| xyseries guid fwdType sourceHost
| search guid="00507345-CE09-4A5E-428-D3E8718CB065"
| appendpipe [ stats count | eval "Duplicate GUID" = if(count==0, "Yes", "No") ]
Which of the following are transforming commands?
Show Answer
Hide Answer
Correct Answer:
C
In Splunk, transforming commands are those that process events to produce statistical summaries, often changing the shape of the data. Among the commands listed:
stats is a transforming command that computes aggregate statistics, such as count, sum, average, etc., and transforms the data into a tabular format.
xyseries is also a transforming command that reshapes the data into a matrix format suitable for charting, converting three columns into a two-dimensional table.
The other commands:
where and search are filtering commands.
fields is a field selector command.
appendpipe is a generating command.
eval is an evaluation command.
eventstats is a reporting command that adds summary statistics to each event.
stats - Splunk Documentation
xyseries - Splunk Documentation
