Visualization of the count of users' event counts

[brajaram]

This is probably a simple answer, but I'm pretty new to splunk and my googling hasn't led me to an answer. So I'm trying to write a query that looks like this:

index=<> sourcetype=<> | stats count by uid

A simple query, just get the number of events per UID(User ID). What I want to display, however, is a visualization of the counts per user ID. For example, if I have 5 user IDs that have 5 events, 6 user IDs that have 6 events, and 7 user IDs that have 3 events, I want a graph that displays 3 columns, with the X-axis being the specific values(3 events, 5 events, 6 events), and the Y value being the corresponding counts of users that fit within those counts(7, 5, 6 specifically).

Its probably a very simple solution, but I can't seem to find an answer, so I'm hoping to find it here. Thanks!

[somesoni2 · Accepted solution]

Try this

index=<> sourcetype=<> | stats count as EventCount by uid | stats count as UserCount by EventCount

[brajaram]

Thanks for the quick response! I was trying things in that vein but couldn't get it to work, but your solution worked perfectly.