Splunk Exam SPLK-1001 Topic 8 Question 98 Discussion

Actual exam question for Splunk's SPLK-1001 exam

Question #: 98
Topic #: 8

How are the results of the following search sorted?

... | sort action, ---file, +bytes

AIn descending order by action, then descending order by file, and lastly by ascending order of bytes.

BIn ascending order by action, then descending order by file, and lastly by ascending order of bytes.

CIn descending order by action if it exists. If not, then in descending order by file, and if both action and file do not exist, by ascending order of bytes.

DIn ascending order by action if it exists. If not, then in descending order by file, and if both action and file do not exist, by ascending order of bytes.

Show Suggested Answer

Suggested Answer: B

Using a minus sign (-) for descending order and a plus sign (+) for ascending order. If no sign is specified, the default order is ascending.

Sorting by multiple fields in the order they are specified. If there are duplicate values in one field, the next field is used to break the tie.

Sorting by field values according to their types. If the field type is not specified, the sort command tries to automatically determine it.

by Lizette at Sep 16, 2024, 09:06 PM

Limited Time Offer

25%

1 months ago

Hmm, the order seems a bit confusing. I'll have to think this one through carefully.

upvoted 0 times

...