Hi what you have in _raw data? Are those real duplicate events or those real events which really should be on logs? If those are correctly in logs and there should be "same" event twice, you probably could mark "duplicates" with streamstats adding some count and then removing those duplicate on your stats count line? see.  https://docs.splunk.com/Documentation/Splunk/9.2.0/SearchReference/Streamstats Something like ... | <set your service> | streamstats time_window=10s count as dup_count by service, <other fields to match events correctly> | where dup_count < 2 | stats .... r. Ismo  ... View more

Yes, chart will sort the columns by name. In order to get around this, you need to use transpose | eval static="Category" | chart count by static category | transpose header_field=static column_name=category | sort - Category | transpose header_field=category column_name=static ... View more