Splunk Distinct Count Formula