https://community.splunk.com/t5/Splunk-Search/How-can-I-remove-duplicate-device-id-from-search-within-5-min/m-p/357195#M105675 <P>You are looking for the<CODE>dc()</CODE> function - distinct count.</P> <P>Try this...</P> <PRE><CODE> | bin _time span=5m | stats dc(device_id) by _time </CODE></PRE> Fri, 29 Sep 2017 05:00:31 GMT DalJeanis 2017-09-29T05:00:31Z https://community.splunk.com/t5/Splunk-Search/How-can-I-remove-duplicate-device-id-from-search-within-5-min/m-p/357194#M105674 <P>How to remove duplicate device_id within five min interval for 24 hours search,</P> <P>for example :<BR /> 10:00am device id =aaa123<BR /> 10:01am device id =aaa123<BR /> 10:02am device id =aaa124<BR /> 10:03am device id =aaa123<BR /> 10:04am device id =aaa123</P> <P>10:05am device id =aaa123<BR /> 10:08am device id =aaa123</P> <P>10:15am device id =aaa123</P> <P>10:25am device id =aaa123</P> <P>expected result:<BR /> _time count <BR /> 10:00 am 2<BR /> 10:05 am 1<BR /> 10:10 am 0<BR /> 10:15 am 1<BR /> 10:20 am 0<BR /> 10:25am 1<BR /> 10:30 am 0</P> Mon, 25 Sep 2017 19:47:39 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-remove-duplicate-device-id-from-search-within-5-min/m-p/357194#M105674 mk197m 2017-09-25T19:47:39Z https://community.splunk.com/t5/Splunk-Search/How-can-I-remove-duplicate-device-id-from-search-within-5-min/m-p/357195#M105675 <P>You are looking for the<CODE>dc()</CODE> function - distinct count.</P> <P>Try this...</P> <PRE><CODE> | bin _time span=5m | stats dc(device_id) by _time </CODE></PRE> Fri, 29 Sep 2017 05:00:31 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-remove-duplicate-device-id-from-search-within-5-min/m-p/357195#M105675 DalJeanis 2017-09-29T05:00:31Z