https://community.splunk.com/t5/Splunk-Search/dedup-with-total-counts/m-p/210944#M176647 <P>Perfect! Thank you!</P> Thu, 22 Sep 2016 18:55:29 GMT phil_dupree 2016-09-22T18:55:29Z https://community.splunk.com/t5/Splunk-Search/dedup-with-total-counts/m-p/210941#M176644 <P>I have been tasked with building a dashboard which shows the total number of transactions today for each server. I can easily get the distinct servers using dedup; however, I am not sure how to directly get the number of transactions for the day. In order for me to find the number of transactions, I can use eval to subtract the min(ID_Number) from the max(ID_Number) for today; but I cannot figure out how to incorporate this with dedup. </P> <P>I would like the results to look something like this:</P> <P>ServerA 105<BR /> ServerB 109<BR /> ServerC 210</P> <P>Any assistance is greatly appreciated!</P> Tue, 29 Sep 2020 11:07:57 GMT https://community.splunk.com/t5/Splunk-Search/dedup-with-total-counts/m-p/210941#M176644 phil_dupree 2020-09-29T11:07:57Z https://community.splunk.com/t5/Splunk-Search/dedup-with-total-counts/m-p/210942#M176645 <P>Using <CODE>stats count(ID_Number) by server</CODE> should get you the results you seek without <CODE>dedup</CODE>.</P> Thu, 22 Sep 2016 18:48:10 GMT https://community.splunk.com/t5/Splunk-Search/dedup-with-total-counts/m-p/210942#M176645 richgalloway 2016-09-22T18:48:10Z https://community.splunk.com/t5/Splunk-Search/dedup-with-total-counts/m-p/210943#M176646 <P>If I understand correctly, one way would be to use the stats to get min &amp; max per server and then use eval command to calculate total transactions for each. Example:</P> <PRE><CODE>... | stats min(ID_Number) as min_id max(ID_Number) as max_id by server | eval num_transactions = max_id - min_id | table server num_transactions </CODE></PRE> Thu, 22 Sep 2016 18:52:04 GMT https://community.splunk.com/t5/Splunk-Search/dedup-with-total-counts/m-p/210943#M176646 bwooden 2016-09-22T18:52:04Z https://community.splunk.com/t5/Splunk-Search/dedup-with-total-counts/m-p/210944#M176647 <P>Perfect! Thank you!</P> Thu, 22 Sep 2016 18:55:29 GMT https://community.splunk.com/t5/Splunk-Search/dedup-with-total-counts/m-p/210944#M176647 phil_dupree 2016-09-22T18:55:29Z