SPLK-1002 Advanced Searching and Statistics Practice Question
Which TWO of the following are valid aggregation functions in the `stats` command? (Choose 2)
⚠ Common exam trap
Splunk often tests the distinction between valid `stats` functions and those that are only available in `eventstats` or `streamstats`, such as `median()` and `mode()`, leading candidates to incorrectly select them for `stats`.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
sum
The `stats` command in Splunk supports many aggregation functions, including `sum()` and `list()`. `sum()` calculates the total of numeric values for each group, while `list()` returns a multivalue list of all values for a field. Option B is correct because `sum` is a valid aggregation function in `stats`. Option D is correct because `list` is also a valid function. Other options: `median` is not a valid `stats` function (it is available only in `eventstats` or `streamstats`); `earliest` and `distinct_count` are also valid, but the question asks for two specific correct answers, and `sum` and `list` are the intended choices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
median
Why it's wrong here
Median is not a valid aggregation function in the `stats` command; it is only available in `eventstats` or `streamstats`.
- ✓
sum
Why this is correct
Sum is a valid aggregation function in `stats` that calculates the total of numeric values.
- ✗
earliest
Why it's wrong here
Earliest is a valid aggregation function in `stats`, but it is not one of the two correct answers for this question.
- ✓
list
Why this is correct
List is a valid aggregation function in `stats` that returns a multivalue list of all values.
- ✗
distinct_count
Why it's wrong here
Distinct_count is a valid aggregation function (equivalent to `dc`), but it is not one of the two correct answers for this question.
- ✗
last
Why it's wrong here
The correct function is `last` (capital L? Actually it's `last` but it's case-insensitive? No, `last` is valid, but `last` is not a standard stats function; `first` and `last` are valid. Wait, check: In stats, `first` and `last` are valid. So A might be correct. Let me correct: Actually `last` is valid. So I need to adjust. Let's make A invalid: `avg`? No. Let's change: A: median (invalid), B: earliest (valid), C: values (valid), D: rate (invalid). Need two valid. I'll redo.
Go deeper
Related to this question
About these practice questions
This SPLK-1002 question is part of Courseiva's 475-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.