Wow, thanks for your solution! It worked like charm! ... View more

it says no results found. But the below query works without the case.   | eval vm_unit=case(vmSize="Standard_F16s_v2",2,vmSize="Standard_F8s_v2",1,vmSize="Standard_F4s",0.5,vmSize="Standard_F2s_v2",0.25) | bin _time span=1h | stats values(vm_unit) as vm_unit values(location) as location by _time id | timechart span=1h usenull=true sum(vm_unit) as vm_count by location | fillnull value=0 ... View more

@ITWhisperer  Apologise, somehow I missed your reply, otherwise, I would have replied back on that thread. Thanks again. Given thumps up to your reply. ... View more

@PickleRick Thanks a ton! It worked! Got my query, just putting it here so that it will be helpful to others. <search> | eval vm_unit=case(vmSize="Standard_F16s_v2",2,vmSize="Standard_F8s_v2",1,vmSize="Standard_F4s",0.5,vmSize="Standard_F2s_v2",0.25) | bin _time span=1h | stats values(vm_unit) as vm_unit values(location) as location by _time id | timechart span=1h usenull=true sum(vm_unit) as vm_count by location | fillnull value=0 ... View more

For e.g. Events are like below: TIME  |  VM_NAME  |  VM_UNIT 2023-03-08 01:05  | MONGO_VM |  1 2023-03-08 01:10  | NODE_VM     |  2 2023-03-08 01:05  | MONGO_VM |  1 The splunk query should return SUM(VM_UNIT): TIME  |  SUM(VM_UNIT) 2023-03-08 01:00  |  3 3rd event has to  ignored since its duplicate of 1st event. Hope its clear. ... View more

Thanks, @PickleRick for your reply. I think your query works. Let me confirm. Basically, I want to sum(vm_unit) on an hourly basis, by ignoring duplicate entries in an hour.   ... View more

@PickleRick Thanks for your reply. I agree with your statement. But how to form the Splunk query to get my expected results? ... View more

Thanks, @gcusello for replying. Your query provides the same output as mine. The issue here is that events got duplicated in our Splunk index for some reason. In a given hour,  there should not be two events for the same vm_name. In order to solve the duplicate issue I am using dc(vm_name) thinking that sum(vm_unit) will avoid the duplicate entries. But in my case sum(vm_unit) includes the duplicate entries. For e.g. consider all my vm entries are duplicated twice. _time count(vm_name) sum(vm_unit) ==> _time 120 200 My expectation is  _time dc(vm_name) sum(vm_unit) ==> _time 60 100 Any help is highly appreciated.   ... View more

Thanks, @woodcock  for your reply! What I am expecting  But what I am getting      ... View more