When using timechart, how many fields can be listed after a by clause?

The correct answer is B. because _time is already implied as the x-axis.. The timechart command automatically uses _time as the x-axis, so it is already accounted for. Because _time implicitly occupies one axis, only one additional field can be specified after the by clause to serve as the split-by (series) dimension. Attempting to add more than one fi

Using Transforming Commands for Visualizations

Question

Options

Abecause timechart doesn't support using a by clause.
Bbecause _time is already implied as the x-axis.
Cbecause one field would represent the x-axis and the other would represent the y-axis.
DThere is no limit specific to timechart.

How the community answered

(40 responses)

A
3% (1)
B
90% (36)
C
3% (1)
D
5% (2)

Explanation

The timechart command automatically uses _time as the x-axis, so it is already accounted for. Because _time implicitly occupies one axis, only one additional field can be specified after the by clause to serve as the split-by (series) dimension. Attempting to add more than one field after by is not supported in timechart, unlike the stats command which supports multiple fields in a by clause.

Topics

#timechart command#by clause#_time field#transforming commands

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice