Splunk Search

Chart based on # of events

jared_anderson
Path Finder

I want to create charts based on number of results. I have tried

"172.20.3.6 (199.0.8.62 OR 199.0.8.57) StoresOutBound | timechart count by ATMs" (ATMs being a searchable field).

The problem is it then separates the chart into the top 10 or so results. I have tried
"172.20.3.6 (199.0.8.62 OR 199.0.8.57) StoresOutBound | timechart count by Events" (Events just being a random word).

This actually works, but then the results are labeled as a null value. I am looking to create a time chart based on number of events.

Tags (3)
0 Karma
1 Solution

jared_anderson
Path Finder

172.20.3.6 (199.0.8.62 OR 199.0.8.57) StoresOutBound | timechart count by Events | rename null as Events

View solution in original post

0 Karma

jared_anderson
Path Finder

172.20.3.6 (199.0.8.62 OR 199.0.8.57) StoresOutBound | timechart count by Events | rename null as Events

0 Karma

ddarmand
Communicator

same question here

0 Karma
Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

New Release | Splunk Cloud Platform 10.1.2507

Hello Splunk Community!We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...