Transforming Commands, Reports, and Dashboards
Transforming commands
Transforming commands turn a stream of events into a results table. The workhorses are stats, chart, timechart, top, rare, and contingency.
stats is the most flexible: | stats count, dc(user) AS users, avg(bytes) AS avg_bytes BY host collapses events into one row per host. count counts events; dc counts distinct values - using count where dc was meant is a classic trap. chart and timechart handle two dimensions: a chart split-by becomes columns, while timechart requires _time, uses a span (or bins) on the time axis, and caps series (default limit 10). top and rare return the top/rarest values of a field with countfield and percentfield; top defaults to 10 results.
If you need aggregates but must keep every event, use eventstats (aggregate added to each row) or streamstats (running/cumulative values in time order). Use bin or span to group _time; table and fields shape columns but are not transforming commands.
Reports and dashboards
A report is a saved search - optionally scheduled with cron, alerted on, and accelerated (report acceleration or summary indexing). Dashboards are XML classic dashboards or Dashboard Studio; both gain speed from a base search with post-process searches, and interactivity from tokens ($tok$) and drilldowns.
Worked example:
index=web status=500 | timechart span=1h count AS errors BY host limit=5
One row per hour, one column per host, series capped at five.
Rule of thumb: filter before transforming, transform as late as possible, and remember everything after a transforming command operates on the table, not on raw events.