https://community.splunk.com/t5/Splunk-Search/How-to-create-a-visualization-showing-event-counts-since/m-p/237105#M70471 <P>thanks sundareshr, it doesn't quite work, there are many transactions starting at different times</P> Wed, 23 Nov 2016 21:39:14 GMT archier 2016-11-23T21:39:14Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-visualization-showing-event-counts-since/m-p/237103#M70469 <P>I have transactions with varying number of events. I want a plot showing how many events occur in buckets since the beginning of the transaction, e.g. how many events in the first 5 seconds, next 5 seconds, etc.</P> <P>How can I do this?</P> Wed, 23 Nov 2016 20:01:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-visualization-showing-event-counts-since/m-p/237103#M70469 archier 2016-11-23T20:01:15Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-visualization-showing-event-counts-since/m-p/237104#M70470 <P>Lets assume you transactions are grouped by a <CODE>txn_id</CODE>. See if this is what you're looking for...</P> <PRE><CODE>index=foo sourcetype=bar | bin span=5s _time | stats count by txn_id _time </CODE></PRE> Wed, 23 Nov 2016 20:46:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-visualization-showing-event-counts-since/m-p/237104#M70470 sundareshr 2016-11-23T20:46:51Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-visualization-showing-event-counts-since/m-p/237105#M70471 <P>thanks sundareshr, it doesn't quite work, there are many transactions starting at different times</P> Wed, 23 Nov 2016 21:39:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-visualization-showing-event-counts-since/m-p/237105#M70471 archier 2016-11-23T21:39:14Z