how to plot count of distinct value over time?

[davidoh0905]

earliest=-6month sourcetype="mysource" | timechart span=1week count by product_name

I was running this in order to see the trend over time. The intention was to see the whole count summation of 1 week over 6 month span. but I am not sure whether this query is showing summation of counts of entire week or just showing single day's count separate by 1week time span.

Please let me know if this is counting the 7 days worth of count or just showing count of one day calculated every 7 days.

Thank you!

[somesoni2]

If your requirement is to get number of events for each product per week, including all 7 days of the week, you already have the query. It's not distinct count of the product.

[sundareshr · Accepted solution]

Your search will show 7 day totals, However, these are not distinct counts. This counts EVERY event index in that sourcetype by product_name in the past 7 days for 6 months.

[davidoh0905]

thank you! could you teach me how to use distinct count??

[sundareshr]

What is it that you want the distinct count of? The below will give your distinct_count of product_name. In other words, it will tell you how many distinct products were in each week for past 6 months.

earliest=-6month sourcetype="mysource" | timechart span=1week dc(product_name) 

[davidoh0905]

Thank you! @sundareshir

[sundareshr]

Please mark the question as answered to close it out.

[kunalmao]

It is showing you the summation of 7 days starting your period of 6 months. The query is serving you the purpose, additionally if you are interested in getting no repeated values you can pipe a dedup before timechart.