Data models and datasets are designed by the knowledge managers in your organization. The Pivot tool requires data models and datasets to define the data that you want to work with. The other options are incorrect because they do not describe the features of the Pivot tool. You can learn more about the Pivot tool from the Splunk documentation1 or watch a video tutorial2. You can use a drag-and-drop interface to design and generate pivots that present different aspects of your data in the form of tables, charts, and other visualizations. This is because the Pivot tool is a feature of Splunk that allows you to report on a specific data set without using the Splunk Search Processing Language (SPL). Therefore, option C is the correct answer. The yellow line has a steady increase from 0 to 15, while the blue line has a sharp increase from 0 to 5, then a decrease to 0, and then a sharp increase to 10.The yellow line represents “shipped” and the blue line represents “success”.The y-axis is labeled with numbers from 0 to 15.The x-axis is labeled with dates from Wed, to Tue, Apr 10, 2018.It is a line graph with two lines, one yellow and one blue.It uses timechart count by status to create a time-based chart that shows the count of transactions for each status value over time.It uses transaction status maxspan=1d to group events into transactions based on the status field with a maximum time span of one day between the first and last events in a transaction.It uses fields sourcetype, status to keep only the sourcetype and status fields in the events.It uses sourcetype=Savesplunker to filter events by the sourcetype that indicates the Splunk Enterprise Security app.It uses index_internal to specify the internal index that contains Splunk logs and metrics.Index_internal sourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan=1d | timechart count by status

The following search would create a graph similar to the one below:

Splunk transaction single startswith