Splunk Search

count duplicates with results in single value with trendline

Mike6960
Path Finder

I want to count duplicates of certain fields in my data. I am using this search:

..mysearch...| chart count(O_D) as "B_D" by G_B span=1d
| where B_D >1
|stats count ("B_D")

This gives the result I want, but I want to present this in a single value with a trendline. I tried replacing chart with timechart but then the result ends in 0

Tags (1)
0 Karma

HiroshiSatoh
Champion

timechart uses _time. Do _time exist in the previous result?

If you use the time chart, this field name will also be changed. Please also check the field name.

0 Karma

Mike6960
Path Finder

what previous result do you mean? Which field name do you mean? If i run my search, i still see _time in my raw events

0 Karma

HiroshiSatoh
Champion

Can I provide changed search sentences?

0 Karma

Mike6960
Path Finder

Yes please

0 Karma

Mike6960
Path Finder

or did i understand you wrong?

0 Karma
Get Updates on the Splunk Community!

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...

New Year. New Skills. New Course Releases from Splunk Education

A new year often inspires reflection—and reinvention. Whether your goals include strengthening your security ...