https://community.splunk.com/t5/Splunk-Search/How-to-create-a-more-efficient-sitimechart-for-distinct-count/m-p/488094#M136382 <P>Hi @pr0n,</P> <P>If you're just looking to store the distinct count without the detailed <CODE>multi-value</CODE>, then all you have to do is save a <CODE>timechart</CODE> into a summary index using <CODE>| collect</CODE> instead of using <CODE>sitimechart</CODE>.</P> <P>Cheers,<BR /> David</P> Thu, 16 Jan 2020 15:33:57 GMT DavidHourani 2020-01-16T15:33:57Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-more-efficient-sitimechart-for-distinct-count/m-p/488093#M136381 <P>When using <CODE>index=blah | sitimechart dc(field1) by field2</CODE> It saves every single element for field1 concatenated into a new field called psrsvd_vm_field1. For me this makes for an insanely inefficient summary index with millions and millions of useless entries in the psrsvd_vm_field1 field. How can I streamline this so that it doesn't store all that information and have to sort through it every time I chart the summarized data.</P> Wed, 30 Sep 2020 03:44:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-more-efficient-sitimechart-for-distinct-count/m-p/488093#M136381 pr0n 2020-09-30T03:44:29Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-more-efficient-sitimechart-for-distinct-count/m-p/488094#M136382 <P>Hi @pr0n,</P> <P>If you're just looking to store the distinct count without the detailed <CODE>multi-value</CODE>, then all you have to do is save a <CODE>timechart</CODE> into a summary index using <CODE>| collect</CODE> instead of using <CODE>sitimechart</CODE>.</P> <P>Cheers,<BR /> David</P> Thu, 16 Jan 2020 15:33:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-more-efficient-sitimechart-for-distinct-count/m-p/488094#M136382 DavidHourani 2020-01-16T15:33:57Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-more-efficient-sitimechart-for-distinct-count/m-p/488095#M136383 <P>How do I timechart the summary? My understanding is I need sitimechart to prepare data for proper timechart once it's summarized.</P> Thu, 16 Jan 2020 15:36:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-more-efficient-sitimechart-for-distinct-count/m-p/488095#M136383 pr0n 2020-01-16T15:36:44Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-more-efficient-sitimechart-for-distinct-count/m-p/488096#M136384 <P>Well it depends on what you're trying to achieve, because if you need to be able to run a <CODE>dc</CODE> over any time <CODE>span</CODE> then you will need that inefficient mv field. But if you're only interested in keeping a specific time interval in your summary then going for the results of a <CODE>timechart</CODE> would do the trick for you. <BR /> It'll only save <CODE>_time</CODE> and <CODE>dc</CODE> value instead of saving <CODE>_time</CODE>, <CODE>dc</CODE>and all values.</P> Thu, 16 Jan 2020 15:50:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-more-efficient-sitimechart-for-distinct-count/m-p/488096#M136384 DavidHourani 2020-01-16T15:50:21Z