Splunk Search

How to build a chart on unique field

wish2hate
New Member

I am trying to achieve building multiple area graph on one chart where my input is:

foo=blue
foo=purple
foo=red
foo=red
foo=red
foo=purple

And when I do splunk search, I would expect my search to be:

{get all logs} | top limit=0 "foo" | fields "foo" count

Where I would produce the following results:

red:       3
purple:  2
blue:      1

Now what I am seeking to get this type of count by time with all 3 different fields in ONE area graph.
Can someone please show me how to do this?

0 Karma

kiamco
Path Finder

you might want to just use a
|timechart

like

...base search
|timechart count(foo) by foo
0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...