For the following search, which field populates the x-axis? index=security sourcetype=linux secure | timechart count by action

Question

Options

• Aaction
• Bsource type
• C_time
• Dtime

• A
  3% (1)
• B
  5% (2)
• C
  92% (35)

Explanation

The timechart command creates a time series chart with corresponding table of statistics, with time used as the X-axis. You can specify a split-by field, where each distinct value of the split-by field becomes a series in the chart. In this case, the split-by field is action, which means that the chart will have different lines for different actions, such as accept, reject, or fail. The count function will calculate the number of events for each action in each time bin. For example, the following image shows a timechart of the count by action for a similar search: As you can see, the x-axis is populated by the _time field, which represents the time range of the search. The y-axis is populated by the count function, which represents the number of events for each action. The legend shows the different values of the action field, which are used to split the chart into different series.

No community discussion yet for this question.