diff --git a/web/docs/operators/chart.md b/web/docs/operators/chart.md index 178e89c433d..207847b69e0 100644 --- a/web/docs/operators/chart.md +++ b/web/docs/operators/chart.md @@ -23,40 +23,44 @@ The `chart` operator adds attributes to the schema of the input events, that are used to guide rendering of the data as a chart. The operator does no rendering itself. +The `fields` option value is either the name of a single field, or a +comma-separated list of multiple field names, e.g., `foo,bar,baz`. + ### `-x|--x-axis ` (`line`, `area`, and `bar` charts only) -Set the field used for the X-axis. Defaults to the first field in the schema. +Sets the field used for the X-axis. + +Values in this field must be strictly increasing (sorted in ascending order, +without duplicates) when creating a `line` or `area` chart, or unique when +creating a `bar` chart. -Values in this field must be strictly increasing -(sorted in ascending order, without duplicates) -when creating a `line` or `area` chart, -or unique when creating a `bar` chart. +Defaults to the first field in the schema. ### `-y|--y-axis ` (`line`, `area`, and `bar` charts only) -Set the fields used for the Y-axis. -Can either be a single field, or a list of fields spelled with -a list syntax (`[field1, field2]`). +Sets the fields used for the Y-axis. + Defaults to every field but the first one. ### `position=` (`line`, `area`, and `bar` charts only) -Control how the values are grouped when rendered as a chart. +Controls how the values are grouped when rendered as a chart. Possible values are `grouped` and `stacked`. + Defaults to `grouped`. ### `--name ` (`pie` chart only) -Set the field used for the names of the segments. -Defaults to the first field in the schema. +Sets the field used for the names of the segments. Values in this field must be unique. +Defaults to the first field in the schema. + ### `--value ` (`pie` chart only) -Set the fields used for the value of a segment. -Can either be a single field, or multiple fields delimited with commas -(`field1,field2`). +Sets the fields used for the value of a segment. + Defaults to every field but the first one. ## Examples @@ -67,7 +71,7 @@ Render most common `src_ip` values in `suricata.flow` events as a bar chart: export | where #schema == "suricata.flow" | top src_ip -/* -x and -y are defaulted to `src_ip` and `count` */ +/* -x and -y default to `src_ip` and `count` */ | chart bar ``` diff --git a/web/versioned_docs/version-Tenzir v4.12/operators/chart.md b/web/versioned_docs/version-Tenzir v4.12/operators/chart.md index 178e89c433d..207847b69e0 100644 --- a/web/versioned_docs/version-Tenzir v4.12/operators/chart.md +++ b/web/versioned_docs/version-Tenzir v4.12/operators/chart.md @@ -23,40 +23,44 @@ The `chart` operator adds attributes to the schema of the input events, that are used to guide rendering of the data as a chart. The operator does no rendering itself. +The `fields` option value is either the name of a single field, or a +comma-separated list of multiple field names, e.g., `foo,bar,baz`. + ### `-x|--x-axis ` (`line`, `area`, and `bar` charts only) -Set the field used for the X-axis. Defaults to the first field in the schema. +Sets the field used for the X-axis. + +Values in this field must be strictly increasing (sorted in ascending order, +without duplicates) when creating a `line` or `area` chart, or unique when +creating a `bar` chart. -Values in this field must be strictly increasing -(sorted in ascending order, without duplicates) -when creating a `line` or `area` chart, -or unique when creating a `bar` chart. +Defaults to the first field in the schema. ### `-y|--y-axis ` (`line`, `area`, and `bar` charts only) -Set the fields used for the Y-axis. -Can either be a single field, or a list of fields spelled with -a list syntax (`[field1, field2]`). +Sets the fields used for the Y-axis. + Defaults to every field but the first one. ### `position=` (`line`, `area`, and `bar` charts only) -Control how the values are grouped when rendered as a chart. +Controls how the values are grouped when rendered as a chart. Possible values are `grouped` and `stacked`. + Defaults to `grouped`. ### `--name ` (`pie` chart only) -Set the field used for the names of the segments. -Defaults to the first field in the schema. +Sets the field used for the names of the segments. Values in this field must be unique. +Defaults to the first field in the schema. + ### `--value ` (`pie` chart only) -Set the fields used for the value of a segment. -Can either be a single field, or multiple fields delimited with commas -(`field1,field2`). +Sets the fields used for the value of a segment. + Defaults to every field but the first one. ## Examples @@ -67,7 +71,7 @@ Render most common `src_ip` values in `suricata.flow` events as a bar chart: export | where #schema == "suricata.flow" | top src_ip -/* -x and -y are defaulted to `src_ip` and `count` */ +/* -x and -y default to `src_ip` and `count` */ | chart bar ```