SPLK-1002 · Question #120
When using the timechart command, how can a user group the events into buckets based on time?
The correct answer is A. Using the span argument. The 'span' argument of the timechart command controls the width of each time bucket, such as span=1h or span=30m. No other listed argument performs this function.
Question
When using the timechart command, how can a user group the events into buckets based on time?
Options
- AUsing the span argument.
- BUsing the duration argument.
- CUsing the interval argument.
- DAdjusting the fieldformat options.
How the community answered
(40 responses)- A93% (37)
- C3% (1)
- D5% (2)
Why each option
The 'span' argument of the timechart command controls the width of each time bucket, such as span=1h or span=30m. No other listed argument performs this function.
The span argument explicitly sets the time bucket size used by timechart to group events, for example 'timechart span=1h count by host' creates one data point per hour. Without specifying span, Splunk chooses a default bucket size based on the overall time range of the search.
There is no 'duration' argument in the timechart command; duration is an argument used by the transaction command instead.
There is no 'interval' argument in timechart; the correct argument for time bucketing is span.
fieldformat options control how field values are displayed at output time and have no effect on how timechart groups events into time buckets.
Concept tested: timechart span argument for time bucketing
Source: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart
Topics
Community Discussion
No community discussion yet for this question.