Sample data:
alpha 2
beta 1
gamma 4
delta 3
epsilon 10
zeta 13
eta 3
theta 8
iota 4
kappa 6
The number of entries with a value of at least 1: 10
The number of entries with a value of at least 2: 9
The number of entries with a value of at least 3: 8
The number of entries with a value of at least 4: 6
The number of entries with a value of at least 5: 4
The number of entries with a value of at least 6: 4
The number of entries with a value of at least 7: 3
The number of entries with a value of at least 8: 3
The number of entries with a value of at least 9: 2
The number of entries with a value of at least 10: 2
The number of entries with a value of at least 11: 1
The number of entries with a value of at least 12: 1
The number of entries with a value of at least 13: 1
The chart would be these points: (1,10) (2,9) (3,8) (4,6) (5,4) (6,4) (7,3) (8,3) (9,2) (10,2) (11,1) (12,1) (13,1)
Assuming that you have this extracted as two fields - let's call them "myfield" and "count"
This search language is pretty advanced. And it's a good bet that there's more than one way.
Remember that coming out of the first clause I assume you have a field called "count".
*your search terms here* | eval countAs=mvrange(0,100) | eval countAs=mvindex(countAs,0,count) | mvexpand countAs | stats count by countAs
In english, I give every row a multivalued field called "countAs", whose values are the integers from 0 to 100. For each row I then clip off all the integers above whatever the "count" value for that row is. Then I 'mvexpand' on that field, meaning where I had one row with a multivalued countAs field whose values were "0 1 2", I now have three rows with a single-valued countAs field whose values are those values respectively.
At that point the stats command just has to count up how many rows there are for each value of "countAs".
I also make the assumption that each value of "myfield" appears only once in the incoming rows. If that's not true then replace the final "count" with "dc(myfield)"
Assuming that you have this extracted as two fields - let's call them "myfield" and "count"
This search language is pretty advanced. And it's a good bet that there's more than one way.
Remember that coming out of the first clause I assume you have a field called "count".
*your search terms here* | eval countAs=mvrange(0,100) | eval countAs=mvindex(countAs,0,count) | mvexpand countAs | stats count by countAs
In english, I give every row a multivalued field called "countAs", whose values are the integers from 0 to 100. For each row I then clip off all the integers above whatever the "count" value for that row is. Then I 'mvexpand' on that field, meaning where I had one row with a multivalued countAs field whose values were "0 1 2", I now have three rows with a single-valued countAs field whose values are those values respectively.
At that point the stats command just has to count up how many rows there are for each value of "countAs".
I also make the assumption that each value of "myfield" appears only once in the incoming rows. If that's not true then replace the final "count" with "dc(myfield)"
Thanks, this worked well. I did tweak it with somesoni2's changes and to not have 100 hardcoded:
your search terms here | eventstats max(count) as rangeHigh | eval countAs=mvrange(1,rangeHigh) | eval countAs=mvindex(countAs,0,count-1) | mvexpand countAs | stats count by countAs
Amazing approach!!!.
I believe it needs little change to achieve the correct result.
your search terms here | eval countAs=mvrange(1,100) | eval countAs=mvindex(countAs,0,count-1) | mvexpand countAs | stats count by countAs