I'm trying to count values of field in a time chart with every particular point of time using dedup.
like this ,
index = internal field1 = asterisk field2 = asterisk field3 = asterisk | dedup field3 | time chart count(field3) by field2
but it is giving only total count of (field3) in a row. I want total count at every particular point of time to display in time chart.