stats count by value, grouped by time

[ryastrebov]

Hello!

I analyze DNS-log. I can get stats count by Domain:

| stats count by Domain 

And I can get list of domain per minute'

index=main3   |bucket span=1m _time | stats values(Domain) by _time

But I can't combine this two search... I would like to receive as a result of such a table:

_time     Domain        count
12:51     domain1.com    2
          domain2.com    5
          domain3.net    3
12:52     domain1.com    4
          domain2.com    2
          domain3.net    9

How I can make it?

[jstockamp · Accepted solution]

timechart seems like a better solution here

timechart span=1m count(domain) by domain

should work.

[ryastrebov]

Thank you!
Yes, It's work fine, but in result table contains only the most popular domains. As it can be modified to produce a table of all contained in the log domains?