Sum Field value with no duplicates and how to timechart it.

[Rakesh915473]

Hello Team,

I have just started learning Splunk 🙂

Example: I have done basic search index="xyz" |

I have got some logs like below

Event1 : Field                Value              

                username     Rakesh 

                timestamp    10AM

Event 2: Field                Value

                username     Anitha

                timestamp    11AM

Event 3: Field                Value

                username     Rakesh

                timestamp    12PM

Event 4: Field                Value

                username     Harika

                timestamp    1PM

So, I want a total username count 3 (ignoring duplicate Field Rakesh) and I want to display timechart x-axis: timestamp and y-axis: username total count.

[kamlesh_vaghela]

@Rakesh915473 

You can get distinct username by dc() function like 

index="xyz" | timechart dc(username) as count

But timechart using _time for plotting time spans. To use timestamp under x axis, it should be date or date time.  So can you please share sample data for timestamp ?

KV

[Rakesh915473]

Hello @kamlesh_vaghela 

Thanks for replied,

I can see how many times username is triggered count in time chart, But I want to see field username total count 3(Rakesh, Anitha, Harika) to be plotted in Y-axis, date time is fine on x-axis.

Here username is updated from log all the time, I want to see this total count 11(real time) to be plotted in time chart Y-axis and date time on x-axis.

Thanks in advance for your help.

[kamlesh_vaghela]

@Rakesh915473 

The count in Selected Fields for username is distinct username appeared between selected time range. So when you Weill execute time chart search, will show you all 11 username trends.

Can you please try this?

index="xyz" username=* | timechart useother=f usenull=f count by username

KV

[venkatasri]

Hi @Rakesh915473 

Can you. try this?

<your_search_goes_here>
| timechart count by username

---

An upvote would be appreciated and Accept solution if this reply helps!

[Rakesh915473]

Hi @venkatasri 

I want to print field value to be plotted(real time) in chart Ex: username: 11