https://community.splunk.com/t5/Splunk-Search/How-to-plot-a-graph-with-field-having-duplicate-values/m-p/614092#M213405 <P>Hi, I have a scenario where I receive multiple requests which contain same field value basically OrderNumber. So the backend is receiving duplicate orders from the front end.</P><P>It only happens every now and then and I'd like to plot a graph which can show me when exactly it happens. I think just the count of duplicates vs _time would be enough.</P><P>I've tried using a query but it's giving me a distorted graph. Is there a better way to achieve this?</P><P>Query I have -&nbsp;</P><LI-CODE lang="markup">index=myapp OrderService "HttpMethod=POST" | rex field=_raw "orderNumber\"\:\s\"(?&lt;orderNumber&gt;[^\"]+)" | bin span=15m _time | stats count by _time orderNumber | where count &gt; 1 | table _time count</LI-CODE><P>Let me know if anyone has any suggestions to do this in a better way.</P> Thu, 22 Sep 2022 10:58:58 GMT shashank_24 2022-09-22T10:58:58Z https://community.splunk.com/t5/Splunk-Search/How-to-plot-a-graph-with-field-having-duplicate-values/m-p/614092#M213405 <P>Hi, I have a scenario where I receive multiple requests which contain same field value basically OrderNumber. So the backend is receiving duplicate orders from the front end.</P><P>It only happens every now and then and I'd like to plot a graph which can show me when exactly it happens. I think just the count of duplicates vs _time would be enough.</P><P>I've tried using a query but it's giving me a distorted graph. Is there a better way to achieve this?</P><P>Query I have -&nbsp;</P><LI-CODE lang="markup">index=myapp OrderService "HttpMethod=POST" | rex field=_raw "orderNumber\"\:\s\"(?&lt;orderNumber&gt;[^\"]+)" | bin span=15m _time | stats count by _time orderNumber | where count &gt; 1 | table _time count</LI-CODE><P>Let me know if anyone has any suggestions to do this in a better way.</P> Thu, 22 Sep 2022 10:58:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-plot-a-graph-with-field-having-duplicate-values/m-p/614092#M213405 shashank_24 2022-09-22T10:58:58Z https://community.splunk.com/t5/Splunk-Search/How-to-plot-a-graph-with-field-having-duplicate-values/m-p/614114#M213419 <P>What do you mean by "a distorted graph"?&nbsp; Try removing the the table command as it is dropping a field that may be needed for the graph..</P> Thu, 22 Sep 2022 12:26:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-plot-a-graph-with-field-having-duplicate-values/m-p/614114#M213419 richgalloway 2022-09-22T12:26:33Z