Splunk Fund 2 - Mod 3 (Commands For Visualizations)

SPLUNK FUND 2 - MOD 3 (COMMANDS FOR
VISUALIZATIONS)

When a search returns statistical values it can be viewed as a __________. - Answers-
chart

The chart command can take two clause statements ________ and _________ -
Answers- *Over* and *By*

Any ________ functions can be applied to the chart command - Answers- stats

The ________ clause tells which fields you want to be on the x-axis - Answers- over
(left to right)

The _________ should always be numeric, so it can be charted - Answers- y-axis (up &
down)

The other column can be removed to the argument _________ - Answers- useother=f

In the timechart command _________ is always the x-axis - Answers- time

Any ________ function can be applied to the timechart command - Answers- stats

You can split data in timechart command with the _____ clause - Answers- by

Only _________ value can be specified after the by modifier - Answers- one

limit=, useother= and usenull= are also available to ________ - Answers- timechart

You can change the span of the time of the cluster use the argument ________ -
Answers- span=12hr

Use the ___________ command to compare data over specific time periods - Answers-
timewrap

What are some types of visualizations? - Answers- -Statistics table
-Charts; Line, Column, pie...
-Single value
-Maps
-Many more .....

T/F: all searches can be visually represented? - Answers- False

Only searches returns statistical values