Group by and count distinct

Hi, not sure if this is possible.

Let’s say I have 3 servers, and a field hostname populated with


Logs imported will have the following log_file_path field


What I would like to see is a stacked bar graph (or similar) where I can show
For each hour, show me the number of unique log files (count), stacked by hostname.

This would look something like this (created in Excel)


Is such a thing possible?

You’ll note that Server03 in my example generated more log files than the other servers (or at least, more log files were ingested) and that’s what I want to be able to visualise.

you would be able with the extended search - but not with the default widgets

Thanks - A bit of googling suggests to me that that is an enterprise feature only? (related to “views” ?)

yes - currently it is.

When it is deeper integrated into the system it will become part of the core and so open source.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.