I have data from Jira in Splunk, and issues (stories in particular) are counted multiple times because of modifications. For example I created a story and then edited it. Now it is counted twice in Splunk, but it should only be one story count. How to make sure it is only counted once.
@YuliyaVassilyeva Depending on your search query, there are a few ways. If you're using something common like stats or timechart, you might use distinct count. Example:
| stats dc(story) as DistinctCount
@YuliyaVassilyeva Depending on your search query, there are a few ways. If you're using something common like stats or timechart, you might use distinct count. Example:
| stats dc(story) as DistinctCount
That worked. Thank you!
@YuliyaVassilyeva Glad it worked! Please accept the answer, so others in Splunk Answers know this question has an acceptable answer. 🙂