Description: The field that you specify becomes the first column in the results table. dedup_splitvals Syntax: dedup_splitvals= Description: Specifies whether to remove duplicate values in multivalued BY clause fields. For additional information, see the Usage section in this topic. This is in contrast with the by-clause, where each row represents a single unique combination of values of the group-by fields. When a column-split field is included, the output is a table where each column represents a distinct value of the split-by field. You can change the number of columns by including a. Default: The number of columns included is limited to 10 by default. See the tc options and the where clause sections in this topic. If the field is numerical, discretization is applied using the tc-options argument.
Splunk transaction duration chart series#
By default, when the result are visualized, the columns become the data series in the chart. Description: Specifies a field to use as the columns in the result table. See the Chart options section in this topic. chart-options Syntax: cont | format | limit | sep Description: Options that you can specify to refine the result. For a list of stats functions with descriptions and examples, see Statistical and charting functions. Optional arguments agg Syntax: agg= Description: Specify an aggregator or function. When concatenating values with a period, the search treats both values as strings regardless of their actual type. If both operands are strings, they can be concatenated. For example, with the exception of addition, arithmetic operations might not produce valid results if the values are not numerical. See Usage.įor these evaluations to work, your values need to be valid for the type of operation. For more information, see the Evaluation functions. eval-expression Syntax: | | | | Description: A combination of literals, fields, operators, and functions that represent the value of your destination field. You can use wild card characters in field names. Use the AS clause to place the result into a new field with a name that you specify. sparkline-agg-term Syntax: Description: A sparkline aggregation function. You can use wildcard characters in field names. The function can be applied to an eval expression, or to a field or set of fields. Stats-agg-term Syntax: ( | ) Description: A statistical aggregation function. You must include one of the following arguments when you use the chart command. See Statistical and charting functions.Ĭhart ( | | "("")" ). You must specify a statistical function when you use the chart command. See the Visualization Reference in the Dashboards and Visualizations manual. The results can then be used to display the data as a chart, such as a column, line, area, or pie chart. The chart command is a transforming command that returns your results in a table format.
0 kommentar(er)
