Hi There, I am trying to figure out how to remove duplicates in a custom perfmon counters data that is exported to Splunk. We have a custom perfmon counter implemented for a service, which reports response time of a service when ever it is called. Otherwise, it will be returning the same old data from the last service response until the new request is served. The same service is hosted on multiple hosts and all the host report perfmon data. I am trying to find the average by removing all the consecutive duplicates by host and get an average. index=perfmon collection=ServiceBus counter="Response Time" instance="Service" | dedup Value host consecutive=true | chart avg(Value) This search is not accurate. Example Data : Host 1: Time Servicebus/ResponseTime 00:00:01 460 00:00:02 460 00:00:03 520 00:00:04 520 00:00:05 630 Host 2: Time Servicebus/ResponseTime 00:00:01 480 00:00:02 480 00:00:03 590 00:00:04 590 00:00:05 610 Since we are sending data to Splunk every 1s from all the hosts, this is how the data in the Splunk is represented (as per my knowledge). See below. In this case, the above search is not removing the duplicates. Time Servicebus/ResponseTime Host 00:00:01 460 Host 1 00:00:01 480 Host 2 00:00:02 460 Host 1 00:00:02 480 Host 2 00:00:03 520 Host 1 00:00:03 590 Host 2 00:00:04 520 Host 1 00:00:04 590 Host 2 00:00:05 630 Host 1 00:00:05 610 Host 2 Can someone help me on how to remove consecutive duplicates by host? Thanks, Dayananda ... View more