https://community.splunk.com/t5/Splunk-Search/Max-of-Distinct-Count/m-p/122584#M33040 <P>Give this a try</P> <PRE><CODE>index=x heartbeat AssetType=Linear |bucket span=1m _time | eval DistinctSession=XDI.AssetID | timechart span=1m dc(DistinctSession) as ConcurrentSession by DeviceType | timechart span=1d max(*) by * </CODE></PRE> Tue, 01 Jul 2014 15:48:32 GMT somesoni2 2014-07-01T15:48:32Z https://community.splunk.com/t5/Splunk-Search/Max-of-Distinct-Count/m-p/122578#M33034 <P>I am trying to get a distinct count of two concatenated numbers and then get the max of that distinct count over a time period. My current search works up until the last pipe. I can get the distinct count but not the max of the distinct count. Any help is appreciated!</P> <P>index=x heartbeat AssetType=Linear <BR /> |bucket span=1m _time | eval DistinctSession=XDI.AssetID <BR /> | timechart span=1m dc(DistinctSession) as ConcurrentSession by DeviceType <BR /> | timechart span=1d max(ConcurrentSession) by DeviceType</P> Fri, 27 Jun 2014 14:44:03 GMT https://community.splunk.com/t5/Splunk-Search/Max-of-Distinct-Count/m-p/122578#M33034 pontorito 2014-06-27T14:44:03Z https://community.splunk.com/t5/Splunk-Search/Max-of-Distinct-Count/m-p/122579#M33035 <P>I'd guess the first <CODE>timechart</CODE> assigns one column for each value of <CODE>DeviceType</CODE>, so the second <CODE>timechart</CODE> doesn't find any column named <CODE>DeviceType</CODE>. Try this instead:</P> <PRE><CODE>index=x heartbeat AssetType=Linear | rename XDI.AssetID as DistinctSession | bucket span=1m _time | stats dc(DistinctSession) as ConcurrentSession by _time DeviceType | timechart span=1d max(ConcurrentSession) by DeviceType </CODE></PRE> Fri, 27 Jun 2014 15:18:50 GMT https://community.splunk.com/t5/Splunk-Search/Max-of-Distinct-Count/m-p/122579#M33035 martin_mueller 2014-06-27T15:18:50Z https://community.splunk.com/t5/Splunk-Search/Max-of-Distinct-Count/m-p/122580#M33036 <P>this is close...the DeviceType field is now showing up but I still can't get a max number. For some reason the dc isn't being pulled into the timechart function to compute a max</P> Fri, 27 Jun 2014 15:38:05 GMT https://community.splunk.com/t5/Splunk-Search/Max-of-Distinct-Count/m-p/122580#M33036 pontorito 2014-06-27T15:38:05Z https://community.splunk.com/t5/Splunk-Search/Max-of-Distinct-Count/m-p/122581#M33037 <P>Do the values look right when you leave off the <CODE>timechart</CODE>?</P> <PRE><CODE>index=x heartbeat AssetType=Linear | rename XDI.AssetID as DistinctSession | bucket span=1m _time | stats dc(DistinctSession) as ConcurrentSession by _time DeviceType </CODE></PRE> Fri, 27 Jun 2014 15:49:49 GMT https://community.splunk.com/t5/Splunk-Search/Max-of-Distinct-Count/m-p/122581#M33037 martin_mueller 2014-06-27T15:49:49Z https://community.splunk.com/t5/Splunk-Search/Max-of-Distinct-Count/m-p/122582#M33038 <P>Can you describe what you want the timechart to look like? I'd guess there will be two series: one showing the distinct count, hourly and another showing the max at the daily granularity? </P> Fri, 27 Jun 2014 16:25:39 GMT https://community.splunk.com/t5/Splunk-Search/Max-of-Distinct-Count/m-p/122582#M33038 Ledion_Bitincka 2014-06-27T16:25:39Z https://community.splunk.com/t5/Splunk-Search/Max-of-Distinct-Count/m-p/122583#M33039 <P>I'm trying to distinct count per minute, and then I want the max of those distinct counts per day. Basically I want one number per day - the max value of those per minute counts. A little confusing, I know. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 01 Jul 2014 15:38:34 GMT https://community.splunk.com/t5/Splunk-Search/Max-of-Distinct-Count/m-p/122583#M33039 pontorito 2014-07-01T15:38:34Z https://community.splunk.com/t5/Splunk-Search/Max-of-Distinct-Count/m-p/122584#M33040 <P>Give this a try</P> <PRE><CODE>index=x heartbeat AssetType=Linear |bucket span=1m _time | eval DistinctSession=XDI.AssetID | timechart span=1m dc(DistinctSession) as ConcurrentSession by DeviceType | timechart span=1d max(*) by * </CODE></PRE> Tue, 01 Jul 2014 15:48:32 GMT https://community.splunk.com/t5/Splunk-Search/Max-of-Distinct-Count/m-p/122584#M33040 somesoni2 2014-07-01T15:48:32Z