https://community.splunk.com/t5/Splunk-Search/Display-a-time-chart-for-the-distinct-count-of-values-in-a-field/m-p/453678#M128381 <P>Try this:</P> <PRE><CODE>index=foo (host=abc OR host=xyz) Computer=* | timechart span=1mon dc(Computer) by host </CODE></PRE> Wed, 15 May 2019 12:59:43 GMT richgalloway 2019-05-15T12:59:43Z https://community.splunk.com/t5/Splunk-Search/Display-a-time-chart-for-the-distinct-count-of-values-in-a-field/m-p/453675#M128378 <P>I am beginner to Splunk and could you help me with the following scenario.</P> <P>Lets take I have a table with the field name "Computer". </P> <P>The field Name "Computer" when searched for different time period gives me different values. </P> <P>When I search for April the result is : a,b,c,d,c<BR /> When I search for May the result is : a,b,c,d,e,f,a,b </P> <P>So the distinct count for April is <STRONG>4</STRONG> and for May is <STRONG>6</STRONG>.</P> <P>I would like to create a chart which shows the following.</P> <P>April - 4<BR /> May - 6</P> <P>What search query could I use to display such a chart which shows me the distinct count of field "Computer" on a monthly basis.</P> <P>Thanks in advance.</P> Mon, 13 May 2019 12:00:38 GMT https://community.splunk.com/t5/Splunk-Search/Display-a-time-chart-for-the-distinct-count-of-values-in-a-field/m-p/453675#M128378 veerappan 2019-05-13T12:00:38Z https://community.splunk.com/t5/Splunk-Search/Display-a-time-chart-for-the-distinct-count-of-values-in-a-field/m-p/453676#M128379 <P>The <CODE>timechart</CODE> command has a function for that purpose called <CODE>distinct_count</CODE> (usually, the <CODE>dc</CODE> abbreviation is used).</P> <P>For example:</P> <PRE><CODE>index=foo Computer=* | timechart span=1mon dc(Computer) </CODE></PRE> Mon, 13 May 2019 13:23:59 GMT https://community.splunk.com/t5/Splunk-Search/Display-a-time-chart-for-the-distinct-count-of-values-in-a-field/m-p/453676#M128379 richgalloway 2019-05-13T13:23:59Z https://community.splunk.com/t5/Splunk-Search/Display-a-time-chart-for-the-distinct-count-of-values-in-a-field/m-p/453677#M128380 <P>Thanks @richgalloway for the answer.</P> <P>Probably can you help me with one more question ?</P> <P>If I have two different search criteria like the following <BR /> index=foo host = abc Computer=* | timechart span=1mon dc(Computer)<BR /> index= foo host = xyz Computer=* | timechart span=1mon dc(Computer)</P> <P>Can I integrate both of these into a same chart ?<BR /> I would like display the results of different criteria as different columns in the same chart. Is that possible with the above query ? </P> Tue, 14 May 2019 14:10:37 GMT https://community.splunk.com/t5/Splunk-Search/Display-a-time-chart-for-the-distinct-count-of-values-in-a-field/m-p/453677#M128380 veerappan 2019-05-14T14:10:37Z https://community.splunk.com/t5/Splunk-Search/Display-a-time-chart-for-the-distinct-count-of-values-in-a-field/m-p/453678#M128381 <P>Try this:</P> <PRE><CODE>index=foo (host=abc OR host=xyz) Computer=* | timechart span=1mon dc(Computer) by host </CODE></PRE> Wed, 15 May 2019 12:59:43 GMT https://community.splunk.com/t5/Splunk-Search/Display-a-time-chart-for-the-distinct-count-of-values-in-a-field/m-p/453678#M128381 richgalloway 2019-05-15T12:59:43Z https://community.splunk.com/t5/Splunk-Search/Display-a-time-chart-for-the-distinct-count-of-values-in-a-field/m-p/453679#M128382 <P>Thanks it works perfectly</P> Thu, 16 May 2019 05:15:42 GMT https://community.splunk.com/t5/Splunk-Search/Display-a-time-chart-for-the-distinct-count-of-values-in-a-field/m-p/453679#M128382 veerappan 2019-05-16T05:15:42Z