Splunk Search

count duplicates with results in single value with trendline

Mike6960
Path Finder

I want to count duplicates of certain fields in my data. I am using this search:

..mysearch...| chart count(O_D) as "B_D" by G_B span=1d
| where B_D >1
|stats count ("B_D")

This gives the result I want, but I want to present this in a single value with a trendline. I tried replacing chart with timechart but then the result ends in 0

Tags (1)
0 Karma

HiroshiSatoh
Champion

timechart uses _time. Do _time exist in the previous result?

If you use the time chart, this field name will also be changed. Please also check the field name.

0 Karma

Mike6960
Path Finder

what previous result do you mean? Which field name do you mean? If i run my search, i still see _time in my raw events

0 Karma

HiroshiSatoh
Champion

Can I provide changed search sentences?

0 Karma

Mike6960
Path Finder

Yes please

0 Karma

Mike6960
Path Finder

or did i understand you wrong?

0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...