I'm going to give you what you asked for, but I think you really just need to understand all the different visualizations that are available. Your particular search would be much better off using the basic "timechart" command.
host="localhost" sourcetype=alert_DBMS | timechart count
if you had more than one value for host (or some other field) you could get multiple lines on a single timechart...
host=* sourcetype=alert_DBMS | timechart count by host
Now, the commands that can produce good output for making visualizations (various kinds of charts) are :
timechart, which we've shown you above and is useful for a time-based visualization;
stats, which is the first tool in your tool belt, and which can chew up data in pretty much any way you can imagine, and which throws away the underlying events, so anything that you don't explicitly use in the command is GONE;
eventstats, which does the same thing as stats but then adds the relevant results to each event rather than throwing the events away;
streamstats, which uses the same aggregate commands as stats but processes the records in the order they arrive, and only sees what has gone before, and which adds the relevant results to each event rather than throwing the events away;
chart, which produces a matrix by two fields, with the first field named giving the values for each row, and the second field named giving the values for the column.
Notice, the stats family can have any number of by fields, but chart must have only one or two. For timechart you get _time and any number of calculated fields. It also has some other bells and whistles but I don't want to confuse you with that right now.
On to the chart example you asked for.
Here's a simple, run-anywhere search that will produce a decent chart...
| makeresults
| eval mydata="sam:[oranges,5][bananas,7][grapes,37][apples,19]!!!!david:[oranges,12][grapes,15][pears,19]!!!!olivia:[guanabanas,3][bananas,4][papayas,2][apples,2]"
| makemv delim="!!!!" mydata
| mvexpand mydata
| rex field=mydata "^(?<name>\w*):"
| rex field=mydata max_match=0 "\[(?<fruit>\w*,\w*)\]"
| mvexpand fruit
| rex field=fruit "^(?<fruitname>\w*),(?<fruitcount>\w*)$"
| table name fruitname fruitcount
| rename COMMENT as "everything above this just creates test data"
Results
sam oranges 5
sam bananas 7
sam grapes 37
sam apples 19
david oranges 12
david grapes 15
david pears 19
olivia guanabanas 3
olivia bananas 4
olivia papayas 2
olivia apples 2
Now the chart command...
| chart sum(fruitcount) over fruitname by name
Results:
fruitname david olivia sam
apples 2 19
bananas 4 7
grapes 15 37
guanabanas 3
oranges 12 5
papayas 2
pears 19
As you can see, the chart command actually produces a particular kind of table, with one field values along the top to label each column, and one along the left side to label each row.
Now, if you want a pie chart, you could do
... how many total fruits each person has...
| stats sum(fruitcount) as totalfruits by name
... how many of each fruit there are...
| stats sum(fruitcount) as totalfruits by fruitname
... how many different fruit each person has
| stats dc(fruitname) as fruittypes by name
... how many different people have each fruit
| stats dc(name) as peoplecount by fruitname
... the highest number of each fruits that any person has
| stats max(fruitcount) as maxcount by fruitname
And any of the above could be switched from a pie chart to a bar chart and will work just fine.
