Splunk Search

generate a graph where the x -axis represent number of times the ticket was assigned and Y-axis represent number of tickets

wessam
Explorer

Hello all ,

I need your help as i have list of tickets called "Tickets" and i would like to generate a graph where the x -axis represent number of times the ticket was assigned and Y-axis represent number of tickets
for Ex :
Tickets
AB111
AB111
AB122
AB910
AB122

so i would like to get the below results

Number of times Tickets_numbers
1 1
2 2
3 0

which illustrate that only one ticket was assigned one time however we had 2 tickets that was assigned two times and no tickets was assigned three times

Thanks

Tags (1)
0 Karma

cmerriman
Super Champion

this gave me similar results:

|makeresults|eval ticketId="AB111,AB111,AB122,AB910,AB122"|makemv ticketId delim=","|mvexpand ticketId|eventstats count by ticketId|stats dc(ticketId) by count

so try something like:

|eventstats count as NumTimes by ticketId|stats dc(ticketId) as Ticket_Numbers by NumTimes 

somesoni2
Revered Legend

Or this (will be efficient than using eventstats)

your base search | stats count by NumTimes by ticketId | stats count as Ticket_Numbers by NumTimes

cmerriman
Super Champion

edit:

|stats count as NumTimes by ticketId|stats count as Ticket_Numbers by NumTimes
0 Karma
Get Updates on the Splunk Community!

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...