Using timechart dc() to Count Unique Users per Hour
A Splunk admin wants to track the number of unique users who accessed a system each hour over the past 24 hours. Which search provides the correct result?
Quick Answer
This search is built from two pieces that each map directly onto a requirement in the scenario: timechart span=1h creates one row of output per hour across the specified time range, and dc(user) computes the distinct count of the user field within each of those hourly buckets. Distinct count matters specifically because the goal is unique users per hour, not total login or access events per hour; a user who accessed the system five times in one hour should still only count once, and dc() is the aggregation function designed to collapse repeated values down to a count of the distinct ones. Pairing dc(user) with timechart's span parameter is what turns a single overall distinct-user count into a per-hour time series, which is exactly the hour-by-hour breakdown the scenario asks for. It's worth keeping straight that count() would tell you total events per hour, while values() or list() would return the actual set of users rather than a number, and only dc() answers the specific question of how many unique users were involved. Whenever an exam scenario asks for a count of unique or distinct entities broken out over regular time intervals, timechart with a defined span combined with dc() on the relevant field is the standard, direct way to produce that result.
⚠ Common exam trap
Candidates often confuse `count` (total events) with `dc()` (distinct values), and assuming `values()` or `count by user` can produce a unique user count per time period.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
index=main earliest=-24h | timechart span=1h dc(user) as unique_users
It uses `timechart span=1h dc(user)` to count distinct users per hour over the last 24 hours. The `dc()` function calculates distinct counts, and `span=1h` sets the time bucket to one hour, exactly matching the requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
index=main earliest=-24h | timechart span=1h dc(user) as unique_users
Why this is correct
dc(user) gives distinct count of users per hour with timechart.
- ✗
index=main earliest=-24h | timechart span=1h values(user)
Why it's wrong here
values(user) produces a multivalue field but does not count them.
- ✗
index=main earliest=-24h | stats dc(user) by _time | timechart span=1h dc(user)
Why it's wrong here
stats by _time creates one row per second, not hourly bins. timechart would then use those tiny bins.
- ✗
index=main earliest=-24h | timechart span=1h count by user
Why it's wrong here
This creates separate series for each user, not a single count of unique users.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SPLK-1002 question from scratch — 475 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SPLK-1002
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A search returns events with fields 'user', 'action', and 'count'. The analyst wants to create a timechart showing the number of distinct users performing 'login' actions per hour. Which search is correct?
hard- A.`... | stats dc(user) by _time span=1h`
- B.`... | timechart span=1h dc(by user)`
- ✓ C.`... | timechart span=1h dc(user)`
- D.`... | eval user=user | timechart span=1h count by user`
- E.`... | timechart span=1h sum(count) by user`
Why C: `timechart span=1h dc(user)` computes the distinct count of the 'user' field per 1-hour time bucket, which directly answers the requirement of showing the number of distinct users performing 'login' actions per hour. The `dc()` function in Splunk is the distinct count function, and `timechart` automatically groups events by `_time` into the specified span.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.