Question 1 of 15
A `timechart` split-by field has more than ten values that all matter. How would you prevent series filtering, and why would `head` not solve that problem?
Strong Interview Answer
Use `limit=0` on `timechart`, for example `timechart limit=0 sum(bytes) BY host`. `limit` controls split-by series filtering; `head` limits result rows/events at its point in the pipeline and is not the series-control mechanism.
What to Listen For
- `limit=0` disables timechart series filtering
- distinguishes series limiting from row/event limiting
- does not claim `limit=-1` is the documented no-limit value
- understands that `timechart` uses `_time` as the time axis
Caution
Look for reasoning and documented behavior, not just the name of the command or knowledge object.