Skip to main content

Transforming commands

To create charts visualizations, your search must transform event data into statistical data tables. These statistical tables are required for charts and other kinds of data visualizations.

Search queries generate data structures using transform commands. Different types of charts require these data structures to be configured in a certain way. For example, not all searches that allow you to create bar, line, and area charts can be used to create pie charts.

The primary transforming commands are:

  • chart: the chart command returns your results in a data structure that supports visualization as a chart (such as a column, line, area, and pie chart). You can decide what field is tracked on the x-axis of the chart.
  • timechart: the timechart command returns your results formatted as a time-series chart, where your data is plotted against an X-axis that is always a time field.
  • stats: to create a report showing summary statistics.

Transformation commands are always placed after the search query, associated with the search result using the pipe | operator