Module 2: Using Transforming Commands for Visualizations Flashcards
Explore data structure requirements Explore visualizations types Create and format charts Create and format timecharts Explain when to use each type of reporting command (54 cards)
When a search returns statistical values, results can be viewed with a wide variety of visualization types
- statistics table
- charts: line, column, pie, etc
- single value, gauges
- maps
- many more
Page 36 Mod 2
A ____ is a series sequence of related data points that are plotted in a visualization.
Data series
Page 37 Mod 2
True or False: Data series can generate any statistical or visualization results.
True
Page 37 Mod 2
True or False: Most visualizations require a single series table. (Search results structured as a table with at least two columns).
True
- left most column provides x-axis values
- subsequent columns provide numeric y-axis values for each series in the chart
Page 38 Mod 2
To get multi-series tables, you need to set up the underlying search with reporting search commands like ___ or ____
chart or timechart
Page 39 Mod 2
What does a Time series do?
Displays statistical trends over time
*can be single-series or multi-series
Page 40 Mod 2
What are the 7 chart types?
Line Area Column Bar Bubble Scatter Pie
Page 41 Mod 2
What does a scatter chart show?
It shows trends in the relationships between discrete data values
*generally, it shows discrete values that do not occur at regular intervals or belong to a series
Page 48 Mod 2
What does a bubble chart require?
2 split by fields and 3 statistics:
- 1 for x-axis
- 1 for y-axis
- 1 that determines size of the bubble
Page 49 Mod 2
For line, area, and column charts, where does the x-axis lie?
Horizontal
Page 42-46 Mod 2
Where does the x-axis lie in a bar chart?
Vertical
Page 46 Mod 2
What does the chart command do?
It displays any data series plotted across one or two dimensions.
Page 50 Mod 2
“chart command requirements”
The function defines the value of the y-axis, therefore it should be ___?
Numeric
Page 50 Mod 2
Where do the values from the by clause display when using the chart command?
In legend
Page 50 Mod 2
“chart command requirements”
The first field after the over clause is the ___?
x-axis
Page 50 Mod 2
“chart command requirements”
Using the over and by clauses divides the data into ___?
sub-groupings
Page 50 Mod 2
chart avg(bytes) over host
The host values display over the x-axis
Page 50 mod 2
chart avg(bytes) over host by product_name
The host field is the x-axis and the series is further split by product_name
Page 50 Mod 2
What kind of results will you get if you used the chart command count over field?
Count functions tallies the number of events for each value in the result set
Page 51 Mod 2
How many dimensions can you split your chart results over?
Just 2 dimensions (unlike stats results)
Page 52 Mod 2
What can you use with the “over” clause to split results?
The “by” clause.
Page 52 Mod 2
chart and timechart commands automatically filter results to include the ___ highest values?
10 highest values
*surplus values are grouped into OTHER
Page 54 Mod 2
What do you use if you want to remove empty (NULL) and OTHER field values from displaying?
- useother=f
- usenull=f
Page 55 Mod 2
What is another way you can get rid of null values?
Add itemId=* to the base search
Page 55 Mod 2
