How do I count the occurrences of each distinct requestId and plot it over time? First time the requestId was found will be fine for a datetime.
With this search, I can plot count of each distinct requestId vs requestId, but I need it over time, not requestId.
| stats count by requestId
e.g. search result event
2016-02-19 16:49:14,335 INFO [requestId=c4c6f44b-d28f-4cae-b679-2b1589584a06] [pool-48946-thread-1]
Use chart (or timechart) instead:
| timechart span=1d count by requestId
View solution in original post
Thanks, that was it, then I added | sort - Time .. To sort it by time otherwise it was sorted by the requestId.