Using Transforming Commands for Vizualizations

Question 1

What is the |chart command used for?

Answer 1

Returns results in a table format that can be displayed as a visualization

Question 2

What is the syntax of the |chart command?

Answer 2

|chart <stats-func> (<wc-field>) over <row-split> [by <column-split>] [span=<int><timescale>] [limit=<int>] [useother=<bool>] [usenull=<bool>]</bool></bool></int></timescale></int></column-split></row-split></wc-field></stats-func>

Y-axis: <stats-func> (<wc-field>)
- wc-field is a field with numeric values; supports wildcards</wc-field></stats-func>

X-axis: over <row-split></row-split>

Further split data by including by <column-split></column-split>

Control behavior with:
- span
- limit
- useother
- usenull

Question 3

What is the difference between the chart and stats commands?

Answer 3

The chart command can be split over two fields or dimensions.

Question 4

What does the [useother=<bool>] argument do?</bool>

Answer 4

Completely removes the “Other” column from your results.

Note:
- ONLY a visual change
- Does NOT recalculate the initial results generated by your base search.

Question 5

What does the [usenull=<bool>] argument do?</bool>

Answer 5

Usenull will remove the null column if one exists.

The null column will contain the statistical valuation of any events that did not actually contain the field that the multi-series split was based on.

Question 6

What is the |timechart command used for?

Answer 6

Timechart performs stats aggregations against time.

Time is ALWAYS the x-axis.

Question 7

What is the syntax of the |timechart command?

Answer 7

|timechart <stats-func> (<field>) by <split-by-field> [span=<int><timescale>] [limit=<int>]</int></timescale></int></split-by-field></field></stats-func>

Question 8

What is the key difference between the chart and timechart commands?

Answer 8

Timechart supports only a SINGLE additional split. The x-axis is always time.

Chart can be specified by two fields or dimensions.

Question 9

When using the |timechart command, what will Splunk automatically do?

Answer 9

Splunk will automatically decide what the appropriate buckets for the values of the time field will be based on the time range of your search.

If you want to change the buckets, use the span argument.