Splunk Search
Highlighted

use timechart with dedup values

Path Finder

I'm trying to count values of field in a time chart with every particular point of time using dedup.
like this ,
index = internal field1 = asterisk field2 = asterisk field3 = asterisk | dedup field3 | time chart count(field3) by field2

but it is giving only total count of (field3) in a row. I want total count at every particular point of time to display in time chart.

sorry for typos

0 Karma
Highlighted

Re: use timechart with dedup values

Esteemed Legend

It is very unclear what you mean, what you need, and what the problem is. Perhaps you can get what you heed by taking some part of this:

index="internal" AND field1="*" AND field2="*" AND field3="*"
| timechart count dc(field3) BY field2
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.