Distinct In Splunk Query