topic Re: Sum Field value with no duplicates and how to timechart it. in Splunk Search

Sum Field value with no duplicates and how to timechart it.

Rakesh915473 — Thu, 08 Jul 2021 11:59:52 GMT

Hello Team,

I have just started learning Splunk 🙂

Example: I have done basic search index="xyz" |

I have got some logs like below

Event1 : Field Value

username Rakesh

timestamp 10AM

Event 2: Field Value

username Anitha

timestamp 11AM

Event 3: Field Value

username Rakesh

timestamp 12PM

Event 4: Field Value

username Harika

timestamp 1PM

So, I want a total username count 3 (ignoring duplicate Field Rakesh) and I want to display timechart x-axis: timestamp and y-axis: username total count.

Re: Sum Field value with no duplicates and how to timechart it.

venkatasri — Thu, 08 Jul 2021 12:06:33 GMT

Hi @Rakesh915473

Can you. try this?

<your_search_goes_here> | timechart count by username

---

An upvote would be appreciated and Accept solution if this reply helps!

Re: Sum Field value with no duplicates and how to timechart it.

kamlesh_vaghela — Thu, 08 Jul 2021 14:52:45 GMT

@Rakesh915473

You can get distinct username by dc() function like

index="xyz" | timechart dc(username) as count

But timechart using _time for plotting time spans. To use timestamp under x axis, it should be date or date time. So can you please share sample data for timestamp ?

Re: Sum Field value with no duplicates and how to timechart it.

Rakesh915473 — Thu, 08 Jul 2021 17:44:44 GMT

Hello @kamlesh_vaghela

Thanks for replied,

I can see how many times username is triggered count in time chart, But I want to see field username total count 3(Rakesh, Anitha, Harika) to be plotted in Y-axis, date time is fine on x-axis.

Here username is updated from log all the time, I want to see this total count 11(real time) to be plotted in time chart Y-axis and date time on x-axis.

Thanks in advance for your help.

Re: Sum Field value with no duplicates and how to timechart it.

Rakesh915473 — Thu, 08 Jul 2021 17:47:37 GMT

Hi @venkatasri

I want to print field value to be plotted(real time) in chart Ex: username: 11

Re: Sum Field value with no duplicates and how to timechart it.

kamlesh_vaghela — Fri, 09 Jul 2021 05:04:50 GMT

@Rakesh915473

The count in Selected Fields for username is distinct username appeared between selected time range. So when you Weill execute time chart search, will show you all 11 username trends.

Can you please try this?

index="xyz" username=* | timechart useother=f usenull=f count by username