Splunk Distinct Count Function