Statistical Processing Flashcards
Use ___=false with the chart command if you want to hide the OTHER column.
useother
When using the top command, add the BY clause to ___.
* specify which search mode to return results by
* return results grouped by the field you specify in the BY clause
* return a percentage of events
specify how many results to return
return results grouped by the field you specify in the BY clause
To round numerical values, use the ___ function of the eval command.
round()
When renaming fields with spaces or special characters, use the rename command and include the new field name in ___.
* parenthesis
* double quotes
* None of the above
* single quotes
double quotes
To display the least common values of a field, use the ___ command.
* stats
* top
* Rare
* timechart with common=f option
rare
Which of these functions lists ALL values of the field X?
* values(X)
* list(X)
list
When you use the stats command with a BY clause, what is returned?
one row
* a statistical output for each value of the named field
* numerical statistics on each field if and only if all of the values of that field are numerical
* an error message because you did not include a statistical function
a statistical output for each value of the named field
By default, the sort command lists results in ___ order.
* ascending
* descending
ascending
Which of these eval functions takes no arguments?
* random
* pow
* max
* min
random
If you use the stats command with two functions and a BY clause, which function is the BY clause applied to?
* the first function
* both functions
* the second function
* both functions if they are both aggregate functions
both functions
True or False: Only one field can be created when using the eval command.
* FALSE
* TRUE
False
True or False: Using an OVER and a BY clause with the chart command will create a multiseries data series.
* FALSE
* TRUE
True
The ___(X,Y) eval function returns X to the power of Y.
pow
True or False: You can use wildcards (*) with the rename command to rename multiple fields that match a pattern.
* FALSE
* TRUE
True
The ___ command will always have _time as the X-axis.
timechart
