How do I chart "number of values that are at least"/"number of values that are X or more"

[Raistlan]

Sample data:

alpha   2
beta    1
gamma   4
delta   3
epsilon 10
zeta    13
eta     3
theta   8
iota    4
kappa   6

The number of entries with a value of at least 1: 10

The number of entries with a value of at least 2: 9

The number of entries with a value of at least 3: 8

The number of entries with a value of at least 4: 6

The number of entries with a value of at least 5: 4

The number of entries with a value of at least 6: 4

The number of entries with a value of at least 7: 3

The number of entries with a value of at least 8: 3

The number of entries with a value of at least 9: 2

The number of entries with a value of at least 10: 2

The number of entries with a value of at least 11: 1

The number of entries with a value of at least 12: 1

The number of entries with a value of at least 13: 1

The chart would be these points: (1,10) (2,9) (3,8) (4,6) (5,4) (6,4) (7,3) (8,3) (9,2) (10,2) (11,1) (12,1) (13,1)

[sideview · Accepted solution]

Assuming that you have this extracted as two fields - let's call them "myfield" and "count"

This search language is pretty advanced. And it's a good bet that there's more than one way.

Remember that coming out of the first clause I assume you have a field called "count".

*your search terms here* | eval countAs=mvrange(0,100) | eval countAs=mvindex(countAs,0,count) | mvexpand countAs | stats count by countAs

In english, I give every row a multivalued field called "countAs", whose values are the integers from 0 to 100. For each row I then clip off all the integers above whatever the "count" value for that row is. Then I 'mvexpand' on that field, meaning where I had one row with a multivalued countAs field whose values were "0 1 2", I now have three rows with a single-valued countAs field whose values are those values respectively.

At that point the stats command just has to count up how many rows there are for each value of "countAs".

I also make the assumption that each value of "myfield" appears only once in the incoming rows. If that's not true then replace the final "count" with "dc(myfield)"

[Raistlan]

Thanks, this worked well. I did tweak it with somesoni2's changes and to not have 100 hardcoded:
your search terms here | eventstats max(count) as rangeHigh | eval countAs=mvrange(1,rangeHigh) | eval countAs=mvindex(countAs,0,count-1) | mvexpand countAs | stats count by countAs

[somesoni2]

Amazing approach!!!.

I believe it needs little change to achieve the correct result.

your search terms here | eval countAs=mvrange(1,100) | eval countAs=mvindex(countAs,0,count-1) | mvexpand countAs | stats count by countAs