https://community.splunk.com/t5/Splunk-Search/Chart-based-on-of-events/m-p/89643#M22982 <P>same question here</P> Thu, 14 Feb 2013 09:28:08 GMT ddarmand 2013-02-14T09:28:08Z https://community.splunk.com/t5/Splunk-Search/Chart-based-on-of-events/m-p/89642#M22981 <P>I want to create charts based on number of results. I have tried </P> <P>"172.20.3.6 (199.0.8.62 OR 199.0.8.57) StoresOutBound | timechart count by ATMs" (ATMs being a searchable field). </P> <P>The problem is it then separates the chart into the top 10 or so results. I have tried <BR /> "172.20.3.6 (199.0.8.62 OR 199.0.8.57) StoresOutBound | timechart count by Events" (Events just being a random word). </P> <P>This actually works, but then the results are labeled as a null value. I am looking to create a time chart based on number of events.</P> Wed, 16 Jan 2013 15:31:30 GMT https://community.splunk.com/t5/Splunk-Search/Chart-based-on-of-events/m-p/89642#M22981 jared_anderson 2013-01-16T15:31:30Z https://community.splunk.com/t5/Splunk-Search/Chart-based-on-of-events/m-p/89643#M22982 <P>same question here</P> Thu, 14 Feb 2013 09:28:08 GMT https://community.splunk.com/t5/Splunk-Search/Chart-based-on-of-events/m-p/89643#M22982 ddarmand 2013-02-14T09:28:08Z https://community.splunk.com/t5/Splunk-Search/Chart-based-on-of-events/m-p/89644#M22983 <P>172.20.3.6 (199.0.8.62 OR 199.0.8.57) StoresOutBound | timechart count by Events | rename null as Events</P> Mon, 23 Oct 2017 20:32:57 GMT https://community.splunk.com/t5/Splunk-Search/Chart-based-on-of-events/m-p/89644#M22983 jared_anderson 2017-10-23T20:32:57Z