How to display only one row with duplicated columns

[splunkkid]

Hello,

I am trying to build Splunk Dashboard with my logs in splunk. The rows are like below.

[row 1]

{

 "id" : 123,
 "name" : "A",
 "sub_id" : 444,
 "count" : 25 

}

[row 2]

{

 "id" : 123,
 "name" : "A",
 "sub_id" : 445,
 "count" : 25 

}

As you can see, some of my results have the column with id value is same but sub_id is different.

I need to sum(count) only once if "id" is different, but the results came out as duplicated(not exactly twice, some results have same id with 3 or 4rows, So dividing by 2 is not a good solution.)

I want to build timechart with above data and made SPL like below.

host=[HOST] index=[INDEX] sourcetype=[SOURCETYPE] source=[SOURCE] | bucket span=1d _time | chart limit=0 sum(vm.count) as VM by _time

So, How could I sum count data if the id is same? Thank you,

[ITWhisperer]

When id is the same, are name and count also the same, only sub_id is different?

[splunkkid]

@ITWhisperer 

Yes, you're correct. I want to sum count only once by ID(But not grouping), and create timechart.

[ITWhisperer · Accepted solution]

So using the first vm.count for each vm.id in each bucket would give you the counts you need to sum?

host=[HOST] index=[INDEX] sourcetype=[SOURCETYPE] source=[SOURCE] 
| bucket span=1d _time 
| stats first(vm.count) as vm.count by _time vm.id
| chart limit=0 sum(vm.count) as VM by _time

[splunkkid]

Thank you! That is correct!