After a tstats count of the treasurer's failed logons, the analyst needs a trend table by hour. What is the next SPL step?
Select an answer to reveal the explanation.
Short Explanation
tstats hauls the bricks; stats or chart builds the wall. After the accelerated count, pipe it into a transforming command for the treasurer's hourly trend. tstats is not a fancy rex.
Full Explanation
tstats returns summarized rows that are typically piped to transforming commands such as stats or chart for the final investigation table. It is not a field extractor and does not replace rex. Analysts should combine tstats with a transform when they need a civic trend, not treat tstats as a complete visualization by itself. Writing the output to a new index is unnecessary.