Splunk Search

How to plot count of distinct values over time?

New Member

How do I count the occurrences of each distinct requestId and plot it over time? First time the requestId was found will be fine for a datetime.

With this search, I can plot count of each distinct requestId vs requestId, but I need it over time, not requestId.

| stats count by requestId

e.g. search result event

2016-02-19 16:49:14,335 INFO  [requestId=c4c6f44b-d28f-4cae-b679-2b1589584a06] [pool-48946-thread-1] 
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Use chart (or timechart) instead:

| timechart span=1d count by requestId

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Use chart (or timechart) instead:

| timechart span=1d count by requestId

View solution in original post

0 Karma

New Member

Thanks, that was it, then I added | sort - Time .. To sort it by time otherwise it was sorted by the requestId.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!