SPLK-1002 · Question #300
When using the timechart command, what optional argument is used to specify the interval of _time?
The correct answer is C. span. The span argument in the timechart command defines the time bucket size (interval) used to aggregate events along the time axis. For example, | timechart span=1h count would bucket events into 1-hour intervals. The by clause is used to split results by a field (e.g., by host)…
Question
When using the timechart command, what optional argument is used to specify the interval of _time?
Options
- Abin
- Bby
- Cspan
- Dover
How the community answered
(28 responses)- B4% (1)
- C93% (26)
- D4% (1)
Explanation
The span argument in the timechart command defines the time bucket size (interval) used to aggregate events along the time axis. For example, | timechart span=1h count would bucket events into 1-hour intervals. The by clause is used to split results by a field (e.g., by host), not to set the time interval. The bin command is a separate command used to discretize continuous values but is not an argument of timechart. over is not a valid timechart argument. span is the correct and standard argument for controlling the time resolution of a timechart.
Topics
Community Discussion
No community discussion yet for this question.