In this search, __________ will appear on the y-axis. SEARCH: sourcetype=access_combined status!=200 | chart count over host

Question

Options

• Astatus
• Bhost
• Ccount

• A
  3% (1)
• B
  3% (1)
• C
  93% (28)

Explanation

In this search, count will appear on the y-axis. This search uses the chart command to create a chart of the count of events over host for events that have status not equal to 200. The chart command creates a table with one column for each value of the field after the over clause and one row for each value of the field after the by clause (if any). The values in the table are calculated by applying the function before the over clause to the events in each group. In this case, the chart command creates a table with one column for each host and one row for the count of events for each host. The y-axis of the chart shows the values of the count function applied to each host. Therefore, option C is correct, while options A and B are incorrect because they appear on the x-axis or as labels of the chart.

No community discussion yet for this question.