Which Fields Does the fieldsummary Command Provide?

SPLK-1004 By islever Editorial Last updated

Short answer

ABC count stdev mean

Question

Which of the following fields are provided by the fieldsummary command? (Choose all that apply.)
  1. count Correct Answer
  2. stdev Correct Answer
  3. mean Correct Answer
  4. dc

Key Takeaways

The question tests exact output field names of the fieldsummary command, and the common trap is confusing the stats/eval function 'dc' (distinct count) with the fieldsummary output field 'distinct_count'.

Learn which fields are returned by Splunk's fieldsummary command, including count, stdev, mean, and distinct_count. Community consensus confirms the correct options are A, B, and C, because option D uses 'dc' instead of the actual output field 'distinct_count'.

Common mistake: Selecting D ('dc') is the most common mistake because 'dc' is a well-known alias for distinct count in stats and eventstats. However, fieldsummary returns a field named 'distinct_count', not 'dc', so D is incorrect.

Expert Analysis

Why the Answer Is Correct

The fieldsummary command produces summary statistics for each field in the search results. The official Splunk documentation lists the output fields, which include 'count', 'stdev', 'mean', and 'distinct_count'. Therefore, options A (count), B (stdev), and C (mean) are all valid fields returned by fieldsummary. These fields appear in the output as literal field names, so selecting them is correct.

Why the Other Options Are Wrong

Option D ('dc') is not an output field of the fieldsummary command. While 'dc()' is a function used with stats or eventstats to calculate distinct counts, the fieldsummary command names its corresponding output field 'distinct_count'. As comment [3] notes, "dc is not a field, it is distinct_count." Thus, D is incorrect because the option does not match the real field name.

Community Comment Notes

Community comments largely agree on ABC, with several referencing the official documentation. Comment [5] states "dc is not a field, it is distinct_count" and provides the docs link. Comment [3] reinforces this by explaining that while 'distinct_count' is valid, 'dc' is not. Comment [6] outright says "Correct answer is ABC." A minority comment [7] suggests only A and D, but that overlooks that stdev and mean are always returned as fields (with blank values for non-numeric fields), and it misinterprets 'dc' as a literal field name.

Official Reference

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Fieldsummary

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question asks about the output fields of a specific Splunk command, read each option literally versus the official command reference. Remember that fieldsummary returns 'distinct_count', not 'dc', and use the search command '| fieldsummary' in your own Splunk instance to confirm field names quickly.

Community Votes

ABC
100%

100% of anonymous learners picked answer ABC. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. emlch 👍 3
    all of them. DC = distinct_count
  2. adpafer 👍 2
    All are OK. Just check - index=_internal sourcetype=splunkd | fieldsummary
  3. cagdaskarabag 👍 1
    The fieldsummary command in Splunk provides the following fields in its results: count: The number of events or results with that field. stdev: The standard deviation of the field's values (if numeric). mean: The mean (average) of the field's values (if numeric). distinct_count (dc): The number of unique values in the field. Correct Answer: A. count B. stdev C. mean D. dc All options are correct because these fields are part of the summary statistics provided by the fieldsummary command
  4. teeec 👍 1
    While distinct_count is a valid field of fieldsummary command, option D is "dc" not "distinct_count" so the answer is A,B,C Reference documentation: dc is not a field, it is distinct_count - https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Fieldsummary
  5. marinatedcohort 👍 1
    dc is not a field, it is distinct_count - https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Fieldsummary
Show 2 more comments
  1. Eddie_exam 👍 1
    Correct answer is ABC. See https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Fieldsummary
  2. Derag 👍 1
    The correct answer is A and D. B and C are optional.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Which Default Splunk Role Can Use the Log Event Alert Action?

S-grade

How Do You Query a Summary Index Populated by a Report Named 'Linux Logins'?

S-grade

What Is the Best Choice for Summarizing Data to Improve Search Performance?

S-grade

Where do search debug messages appear for troubleshooting views?

S-grade

Practice All SPLK-1004 Questions

Access 130 questions with complete answers and detailed explanations.

View Full SPLK-1004 Practice Test →

← Back to SPLK-1004 Study Guide