Live
Time-bucketed event counts
Powers the timeline bar chart in the Web UI. Fires on every filter change — must be blazing fast. Separate from /query because it runs independently and concurrently.
get/histogram
Query parameters
qstring
SPL2 filter expression (search part only, before pipes)
fromstring required
tostring
bucketsinteger
Target number of buckets. Server picks the best interval (1s, 5s, 1m, 5m, 1h).
Response
Histogram data
Example response
{
"data": {
"interval": "1m"
}
}