https://community.splunk.com/t5/Splunk-Search/how-to-plot-count-of-distinct-value-over-time/m-p/271418#M81696 <P>What is it that you want the distinct count of? The below will give your distinct_count of product_name. In other words, it will tell you how many distinct products were in each week for past 6 months.</P> <PRE><CODE>earliest=-6month sourcetype="mysource" | timechart span=1week dc(product_name) </CODE></PRE> Tue, 29 Sep 2020 10:22:19 GMT sundareshr 2020-09-29T10:22:19Z https://community.splunk.com/t5/Splunk-Search/how-to-plot-count-of-distinct-value-over-time/m-p/271413#M81691 <P>earliest=-6month sourcetype="mysource" | timechart span=1week count by product_name</P> <P>I was running this in order to see the trend over time. The intention was to see the whole count summation of 1 week over 6 month span. but I am not sure whether this query is showing summation of counts of entire week or just showing single day's count separate by 1week time span.</P> <P>Please let me know if this is counting the 7 days worth of count or just showing count of one day calculated every 7 days.</P> <P>Thank you!</P> Tue, 26 Jul 2016 07:00:24 GMT https://community.splunk.com/t5/Splunk-Search/how-to-plot-count-of-distinct-value-over-time/m-p/271413#M81691 davidoh0905 2016-07-26T07:00:24Z https://community.splunk.com/t5/Splunk-Search/how-to-plot-count-of-distinct-value-over-time/m-p/271414#M81692 <P>It is showing you the summation of 7 days starting your period of 6 months. The query is serving you the purpose, additionally if you are interested in getting no repeated values you can pipe a dedup before timechart. </P> Tue, 26 Jul 2016 12:39:00 GMT https://community.splunk.com/t5/Splunk-Search/how-to-plot-count-of-distinct-value-over-time/m-p/271414#M81692 kunalmao 2016-07-26T12:39:00Z https://community.splunk.com/t5/Splunk-Search/how-to-plot-count-of-distinct-value-over-time/m-p/271415#M81693 <P>Your search will show 7 day totals, However, these are not distinct counts. This counts EVERY event index in that sourcetype by product_name in the past 7 days for 6 months.</P> Tue, 26 Jul 2016 12:39:40 GMT https://community.splunk.com/t5/Splunk-Search/how-to-plot-count-of-distinct-value-over-time/m-p/271415#M81693 sundareshr 2016-07-26T12:39:40Z https://community.splunk.com/t5/Splunk-Search/how-to-plot-count-of-distinct-value-over-time/m-p/271416#M81694 <P>If your requirement is to get number of events for each product per week, including all 7 days of the week, you already have the query. It's not distinct count of the product.</P> Tue, 26 Jul 2016 14:47:38 GMT https://community.splunk.com/t5/Splunk-Search/how-to-plot-count-of-distinct-value-over-time/m-p/271416#M81694 somesoni2 2016-07-26T14:47:38Z https://community.splunk.com/t5/Splunk-Search/how-to-plot-count-of-distinct-value-over-time/m-p/271417#M81695 <P>thank you! could you teach me how to use distinct count??</P> Tue, 26 Jul 2016 15:45:29 GMT https://community.splunk.com/t5/Splunk-Search/how-to-plot-count-of-distinct-value-over-time/m-p/271417#M81695 davidoh0905 2016-07-26T15:45:29Z https://community.splunk.com/t5/Splunk-Search/how-to-plot-count-of-distinct-value-over-time/m-p/271418#M81696 <P>What is it that you want the distinct count of? The below will give your distinct_count of product_name. In other words, it will tell you how many distinct products were in each week for past 6 months.</P> <PRE><CODE>earliest=-6month sourcetype="mysource" | timechart span=1week dc(product_name) </CODE></PRE> Tue, 29 Sep 2020 10:22:19 GMT https://community.splunk.com/t5/Splunk-Search/how-to-plot-count-of-distinct-value-over-time/m-p/271418#M81696 sundareshr 2020-09-29T10:22:19Z https://community.splunk.com/t5/Splunk-Search/how-to-plot-count-of-distinct-value-over-time/m-p/271419#M81697 <P>Thank you! @sundareshir</P> Tue, 26 Jul 2016 16:50:23 GMT https://community.splunk.com/t5/Splunk-Search/how-to-plot-count-of-distinct-value-over-time/m-p/271419#M81697 davidoh0905 2016-07-26T16:50:23Z https://community.splunk.com/t5/Splunk-Search/how-to-plot-count-of-distinct-value-over-time/m-p/271420#M81698 <P>Please mark the question as answered to close it out.</P> Tue, 26 Jul 2016 16:52:26 GMT https://community.splunk.com/t5/Splunk-Search/how-to-plot-count-of-distinct-value-over-time/m-p/271420#M81698 sundareshr 2016-07-26T16:52:26Z