Commands for Visualizations Mod 3 Flashcards
Explore data structure requirements Explore visualizations types Create and format charts Create and format timecharts Explain when to use each type of reporting command
When a search returns statistical values, results can be viewed with a wide variety of visualization types
- statistics table
- charts: line, column, pie, etc
- single value, gauges
- maps
- many more
A ____ is a series sequence of related data points that are plotted in a visualization.
Data series
True or False: Data series can generate any statistical or visualization results.
True
True or False: Most visualizations require search results structured as tables, with at least two columns, a single series.
True
To get multi-series tables, you need to set up the underlying search with reporting search commands like ___ or ____
chart or timechart
Time series
Displays statistical trends over time
*can be single-series or multi-series
What are the 7 chart types?
Line Area Column Bar Bubble Scatter Pie
What does a scatter chart show?
It shows trends in the relationships between discrete data values
*generally, it shows discrete values that do not occur at regular intervals or belong to a series
What does a bubble chart provide?
It provides a way to view a 3-dimensional series.
*The size of the bubble represents the value for the 3rd dimension
For line, area, and column charts, where does the x-axis lie?
Horizontal
Where does the x-axis lie in a bar chart?
Vertical
What does the chart command do?
It displays any series of data that you want to plot
“chart command requirements”
The function defines the value of the y-axis, therefore it should be ___?
Numeric
Where do the values from the by clause display?
In legend
“chart command requirements”
The first field after the over clause is the ___?
x-axis
“chart command requirements”
Using the over and by clauses divides the data into ___?
sub-groupings
chart avg(bytes) over host
The host values display over the x-axis
chart avg(bytes) over host by product_name
The host field is the x-axis and the series is further split by product_name
What kind of results will you get if you used the chart command count over field?
Count functions tallies the number of events for each value in the result set
How many dimensions can you split your chart results over?
Just 2 dimensions (unlike stats results)
What can you use with the “over” clause to split results?
The “by” clause.
chart and timechart commands automatically filter results to include the ___ highest values?
10 highest values
*surplus values are grouped into OTHER
What do you use if you want to remove empty (NULL) and OTHER field values from displaying?
- useother=f
- usenull=f
What is another way you can get rid of null values?
Add itemId=* to the base search
What argument would you use to adjust the number of plotted series?
limit argument
When you have a split by two dimensions which option does the limit argument apply to?
It applies to the second split.
What doe the timechart command do?
It performs statistical aggregations against time and plots and trends data over time
What axis is _time always on?
The x-axis
What form are timecharts best for?
Line and Area charts
True or False: Functions and arguments used with stats and chart can also be used with timechart?
True
Unlike stats how many fields can be specified after the by clause when using the timechart command?
One
Why can you only use 1 field after the by clause when using the timechart command?
Because _time is the implied first b field.
Which axis represents the count for each filed value?
The y-axis
What happens when the multi-series mode is set to NO?
All fields share the y-axis
What happens when the multi-series mode is set to YES?
The y-axis is split for each field value
When you use the timechart command it buckets the values of the _time field, which does what for the user?
This provides dynamic sampling intervals, based upon the time range of the search
True or False: Like with the stats and chart commands, you can apply statistical functions to the timechart command?
True, you can add statistical functions
List the functions of the Trellis layout?
- It displays multiple charts based on one result set
- Allows visual comparison between different categories
- Data only fetched once
What should you use if you want to calculate statistics with an arbitrary field as the x-axis that is not _time?
You should use a chart
When you use a by clause with the chart command what is the output?
It is a table and each column represents a distinct value of the split-by field
When would you want to use the timechart command to calculate statistics?
When you want the x-axis to have _time
What happens when you introduce a by clause to the timechart command?
It becomes a table and each column represents a distinct value of the split-by field
When is a good time to use the stats command to calculate statistics?
When you want to use 2 or more fields that are not time-based
What command should you use when you want to count the frequency of a field(s)?
You should use the top and rare command
