Dispay timechart with and without dedup in one search

[raffelschnaffel]

Morning everyone,

i want to display for my search two timecharts, one with and one without dedup of a certain field.

Thanks!

[PickleRick]

The answer will depend greatly on your particular use case. If it's a simple count, @dural_yyz 's answer is what you're looking for. But if you're trying to calculate some more complicated stats it might be more troublesome to do and it might turn out that it's easier to just have two separate searches (possibly appended within one aggregating search). The approach I'd probably use would be to find unique values, mark them and use eval-based stats to calculate "deduped" stats.

[dural_yyz]

| timechart count(field) as TotalVolume, dc(field) as UniqueFieldValues

Depending on what you need the above might not be it, it was a little confusing so the other option from what I speculate you need is.

Do the timechart to 'count by field' and then eventstats to calculate the total.

[raffelschnaffel]

Thank you for your reply and sorry for the confusing description.

I have a basic search and want to output two graphics by timecahrt:

-first contains timechart of my search

-second contains the same timechart of the same search, but with a dedup of one specific field in the search.

Hope it clarifies a bit my request.

Thanks

[dural_yyz]

If this is a report then put both inside the same timechart and trellis the results to get your 2 graphics.  If this is a dashboard then create a base search and then 2 viz that pull from the same base search but augment each with a unique timechart command.