Splunk Search

generate a graph where the x -axis represent number of times the ticket was assigned and Y-axis represent number of tickets

wessam
Explorer

Hello all ,

I need your help as i have list of tickets called "Tickets" and i would like to generate a graph where the x -axis represent number of times the ticket was assigned and Y-axis represent number of tickets
for Ex :
Tickets
AB111
AB111
AB122
AB910
AB122

so i would like to get the below results

Number of times Tickets_numbers
1 1
2 2
3 0

which illustrate that only one ticket was assigned one time however we had 2 tickets that was assigned two times and no tickets was assigned three times

Thanks

Tags (1)
0 Karma

cmerriman
Super Champion

this gave me similar results:

|makeresults|eval ticketId="AB111,AB111,AB122,AB910,AB122"|makemv ticketId delim=","|mvexpand ticketId|eventstats count by ticketId|stats dc(ticketId) by count

so try something like:

|eventstats count as NumTimes by ticketId|stats dc(ticketId) as Ticket_Numbers by NumTimes 

somesoni2
Revered Legend

Or this (will be efficient than using eventstats)

your base search | stats count by NumTimes by ticketId | stats count as Ticket_Numbers by NumTimes

cmerriman
Super Champion

edit:

|stats count as NumTimes by ticketId|stats count as Ticket_Numbers by NumTimes
0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...