A is the correct answer
Chart syntax is: over = [row-split] by = [column-split]
By default, the first field name after the chart command is the [row-split] and the second is [column-split], so B would be the same as the example in the question
https://docs.splunk.com/Documentation/Splunk/8.1.2/SearchReference/Chart
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
kbisht
Highly Voted 3 years, 1 month agosid2051
Highly Voted 3 years agoBibs_s
Most Recent 1 month, 1 week agoHarrysa
5 months, 3 weeks agoemlch
1 year, 3 months agonupacniyiveli
1 year, 9 months agoBengieQuesada
2 years, 1 month agoLalithadevi
2 years, 6 months agorobotn1k
2 years, 7 months agoallansid
2 years, 11 months agooksey
3 years, 1 month agoSartarus
3 years, 1 month ago