Transforming commands

To create charts visualizations, your search must transform event data into statistical data tables. These statistical tables are required for charts and other kinds of data visualizations.

Search queries generate data structures using transform commands. Different types of charts require these data structures to be configured in a certain way. For example, not all searches that allow you to create bar, line, and area charts can be used to create pie charts.

The primary transforming commands are:

• chart: for creating charts that can display any series of data. When creating a chart, you can define which field is tracked along the chart's X-axis
• timechart: for creating "time dependency" reports, meaning time is always the X-axis
• stats: for creating a report that displays summary statistics

Transformation commands are always placed after the search query, associated with the search result using the pipe | operator.