Hello, I am trying to build Splunk Dashboard with my logs in splunk. The rows are like below. [row 1] { "id" : 123, "name" : "A", "sub_id" : 444, "count" : 25 } [row 2] { "id" : 123, "name" : "A", "sub_id" : 445, "count" : 25 } As you can see, some of my results have the column with id value is same but sub_id is different. I need to sum(count) only once if "id" is different, but the results came out as duplicated(not exactly twice, some results have same id with 3 or 4rows, So dividing by 2 is not a good solution.) I want to build timechart with above data and made SPL like below. host=[HOST] index=[INDEX] sourcetype=[SOURCETYPE] source=[SOURCE] | bucket span=1d _time | chart limit=0 sum(vm.count) as VM by _time So, How could I sum count data if the id is same? Thank you,
... View more