@chashi instead of performing x-axis aggregation using stats, you can use streamstats to create a counter | streamstats count as sno . Try the following run anywhere example using Splunk's internal index. index="_internal" sourcetype=splunkd log_level!=INFO NOT (component IN ("Metrics","PeriodicHealthReporter")) | eval event_message=substr(event_message,1,30) | stats count by component event_message | streamstats count as sno | stats last(sno) as "X-Axis" max(count) as "Y-Axis" by component event_message If you want to show all data labels on x-axis with interval of 1, you can add the following Simple XML configuration to you chart for x-axis label major unit. <option name="charting.axisLabelsX.majorUnit">1</option> ... View more