When using timechart, how many fields can be listed after a by clause?

When using timechart, how many fields can be listed after a by clause?
A . because timechart doesn’t support using a by clause.
B . because _time is already implied as the x-axis.
C . because one field would represent the x-axis and the other would represent the y-axis.
D . There is no limit specific to timechart.

View Answer

Answer: B

Explanation:

The timechart command is used to create a time-series chart of statistical values based on your search results2. You can use the timechart command with a by clause to split the results by one or more fields and create multiple series in the chart2. However, you can only list one field after the by clause when using the timechart command because _time is already implied as the x-axis of the chart2. Therefore, option B is correct, while options A, C and D are incorrect.