Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

ag-Power User Splunk > Commands for Visualizations Mod 3 > Flashcards

Commands for Visualizations Mod 3 Flashcards

Explore data structure requirements Explore visualizations types Create and format charts Create and format timecharts Explain when to use each type of reporting command

1
Q

When a search returns statistical values, results can be viewed with a wide variety of visualization types

A
  • statistics table
  • charts: line, column, pie, etc
  • single value, gauges
  • maps
  • many more
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

A ____ is a series sequence of related data points that are plotted in a visualization.

A

Data series

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

True or False: Data series can generate any statistical or visualization results.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

True or False: Most visualizations require search results structured as tables, with at least two columns, a single series.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

To get multi-series tables, you need to set up the underlying search with reporting search commands like ___ or ____

A

chart or timechart

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Time series

A

Displays statistical trends over time

*can be single-series or multi-series

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the 7 chart types?

A 
Line
Area
Column
Bar
Bubble
Scatter
Pie
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What does a scatter chart show?

A

It shows trends in the relationships between discrete data values
*generally, it shows discrete values that do not occur at regular intervals or belong to a series

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What does a bubble chart provide?

A

It provides a way to view a 3-dimensional series.

*The size of the bubble represents the value for the 3rd dimension

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

For line, area, and column charts, where does the x-axis lie?

A

Horizontal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Where does the x-axis lie in a bar chart?

A

Vertical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What does the chart command do?

A

It displays any series of data that you want to plot

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

“chart command requirements”

The function defines the value of the y-axis, therefore it should be ___?

A

Numeric

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Where do the values from the by clause display?

A

In legend

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

“chart command requirements”

The first field after the over clause is the ___?

A

x-axis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

“chart command requirements”

Using the over and by clauses divides the data into ___?

A

sub-groupings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

chart avg(bytes) over host

A

The host values display over the x-axis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

chart avg(bytes) over host by product_name

A

The host field is the x-axis and the series is further split by product_name

19
Q

What kind of results will you get if you used the chart command count over field?

A

Count functions tallies the number of events for each value in the result set

20
Q

How many dimensions can you split your chart results over?

A

Just 2 dimensions (unlike stats results)

21
Q

What can you use with the “over” clause to split results?

A

The “by” clause.

22
Q

chart and timechart commands automatically filter results to include the ___ highest values?

A

10 highest values

*surplus values are grouped into OTHER

23
Q

What do you use if you want to remove empty (NULL) and OTHER field values from displaying?

A
  • useother=f

- usenull=f

24
Q

What is another way you can get rid of null values?

A

Add itemId=* to the base search

25
Q

What argument would you use to adjust the number of plotted series?

A

limit argument

26
Q

When you have a split by two dimensions which option does the limit argument apply to?

A

It applies to the second split.

27
Q

What doe the timechart command do?

A

It performs statistical aggregations against time and plots and trends data over time

28
Q

What axis is _time always on?

A

The x-axis

29
Q

What form are timecharts best for?

A

Line and Area charts

30
Q

True or False: Functions and arguments used with stats and chart can also be used with timechart?

A

True

31
Q

Unlike stats how many fields can be specified after the by clause when using the timechart command?

A

One

32
Q

Why can you only use 1 field after the by clause when using the timechart command?

A

Because _time is the implied first b field.

33
Q

Which axis represents the count for each filed value?

A

The y-axis

34
Q

What happens when the multi-series mode is set to NO?

A

All fields share the y-axis

35
Q

What happens when the multi-series mode is set to YES?

A

The y-axis is split for each field value

36
Q

When you use the timechart command it buckets the values of the _time field, which does what for the user?

A

This provides dynamic sampling intervals, based upon the time range of the search

37
Q

True or False: Like with the stats and chart commands, you can apply statistical functions to the timechart command?

A

True, you can add statistical functions

38
Q

List the functions of the Trellis layout?

A
  • It displays multiple charts based on one result set
  • Allows visual comparison between different categories
  • Data only fetched once
39
Q

What should you use if you want to calculate statistics with an arbitrary field as the x-axis that is not _time?

A

You should use a chart

40
Q

When you use a by clause with the chart command what is the output?

A

It is a table and each column represents a distinct value of the split-by field

41
Q

When would you want to use the timechart command to calculate statistics?

A

When you want the x-axis to have _time

42
Q

What happens when you introduce a by clause to the timechart command?

A

It becomes a table and each column represents a distinct value of the split-by field

43
Q

When is a good time to use the stats command to calculate statistics?

A

When you want to use 2 or more fields that are not time-based

44
Q

What command should you use when you want to count the frequency of a field(s)?

A

You should use the top and rare command

ag-Power User Splunk (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions