A.To show peaks and/or valleys in the timeline, which can indicate spikes in activity or downtime

B.To zoom in and zoom out. although this does not change the scale of the chart

C.To differentiate between structured and unstructured events in the data

D.To sort the events returned by the search command in chronological order

A.index=security failure | stats dc(count) as "Event Count"

B.index=security failure | stats sum as "Event Count"

C.index=security failure | stats count by "Event Count"

D.index=security failure | stats count as "Event Count"

A.fields +

B.dedup

C.rename

D.sort -

A.|

B.!

C.$

D.,