How to create a graph using distinct values?

[carlsonbJTEKT]

I want to create a graph that shows values over time, but I cannot figure out how to graph distinct values. Right now, I can only graph sum or median or average. How do you graph distinct values on a graph?

[aweitzman]

I don't recommend this, since Splunk isn't really meant for this, but you can fake it if you reduce the time span to something where you can guarantee that you'll only get one event per span, and then graph that. So if your events are at least 3 seconds apart, you can do:

... | timechart span=3s values(MyField)

The "Line" chart will show what you want when formatted appropriately.

There are major problems with this, though, due to limits on items that can be graphed, as well as total number of rows in your time chart. You'd be better off in the long run trying to find another useful way to visualize your data.

[woodcock]

Like this:

... | timechart span=1h dc(fieldname)