Splunk Search

How to plot count of distinct values over time?

monojetski
New Member

How do I count the occurrences of each distinct requestId and plot it over time? First time the requestId was found will be fine for a datetime.

With this search, I can plot count of each distinct requestId vs requestId, but I need it over time, not requestId.

| stats count by requestId

e.g. search result event

2016-02-19 16:49:14,335 INFO  [requestId=c4c6f44b-d28f-4cae-b679-2b1589584a06] [pool-48946-thread-1] 
0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

Use chart (or timechart) instead:

| timechart span=1d count by requestId

View solution in original post

0 Karma

javiergn
SplunkTrust
SplunkTrust

Use chart (or timechart) instead:

| timechart span=1d count by requestId

View solution in original post

0 Karma

monojetski
New Member

Thanks, that was it, then I added | sort - Time .. To sort it by time otherwise it was sorted by the requestId.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!