https://community.splunk.com/t5/Splunk-Search/How-to-plot-count-of-distinct-values-over-time/m-p/212518#M62253 <P>Use chart (or timechart) instead:</P> <PRE><CODE>| timechart span=1d count by requestId </CODE></PRE> Fri, 19 Feb 2016 15:51:52 GMT javiergn 2016-02-19T15:51:52Z https://community.splunk.com/t5/Splunk-Search/How-to-plot-count-of-distinct-values-over-time/m-p/212517#M62252 <P>How do I count the occurrences of each distinct requestId and plot it over time? First time the requestId was found will be fine for a datetime.</P> <P>With this search, I can plot count of each distinct requestId vs requestId, but I need it over time, not requestId.</P> <PRE><CODE>| stats count by requestId </CODE></PRE> <P>e.g. search result event</P> <PRE><CODE>2016-02-19 16:49:14,335 INFO [requestId=c4c6f44b-d28f-4cae-b679-2b1589584a06] [pool-48946-thread-1] </CODE></PRE> Fri, 19 Feb 2016 06:57:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-plot-count-of-distinct-values-over-time/m-p/212517#M62252 monojetski 2016-02-19T06:57:18Z https://community.splunk.com/t5/Splunk-Search/How-to-plot-count-of-distinct-values-over-time/m-p/212518#M62253 <P>Use chart (or timechart) instead:</P> <PRE><CODE>| timechart span=1d count by requestId </CODE></PRE> Fri, 19 Feb 2016 15:51:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-plot-count-of-distinct-values-over-time/m-p/212518#M62253 javiergn 2016-02-19T15:51:52Z https://community.splunk.com/t5/Splunk-Search/How-to-plot-count-of-distinct-values-over-time/m-p/212519#M62254 <P>Thanks, that was it, then I added | sort - Time .. To sort it by time otherwise it was sorted by the requestId.</P> Sat, 20 Feb 2016 11:07:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-plot-count-of-distinct-values-over-time/m-p/212519#M62254 monojetski 2016-02-20T11:07:11Z