<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Counting unique values per session ID in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Counting-unique-values-per-session-ID/m-p/710078#M58071</link>
    <description>&lt;P&gt;I'm trying to count the unique values of a field by the common ID (session ID) but only once (one event). Each sessionID could have multiples of each unique field value.&lt;/P&gt;&lt;P&gt;Initially I was getting the count of every event which isn't what I want to count and if I 'dedup' the sessionID then I only get one of the unique field values back.&amp;nbsp;&lt;/P&gt;&lt;P&gt;Is it possible to count one event per session ID for each unique field value?&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;EM&gt;"stats values("field") by sessionID"&amp;nbsp;&lt;/EM&gt; gets me close but in the table it lists the sessionIDs whereas I'm hoping to get the number (count) of unique sessionIDs&amp;nbsp;&lt;/P&gt;&lt;TABLE border="1" width="33.333333333333336%"&gt;&lt;TBODY&gt;&lt;TR&gt;&lt;TD width="25%" height="25px"&gt;Field&lt;/TD&gt;&lt;TD width="25%" height="25px"&gt;sessionID&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="25%" height="25px"&gt;value1&lt;/TD&gt;&lt;TD width="25%" height="25px"&gt;&lt;P&gt;ABC123&lt;/P&gt;&lt;P&gt;123ABC&lt;/P&gt;&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="25%" height="25px"&gt;value2&lt;/TD&gt;&lt;TD width="25%" height="25px"&gt;ABC123&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="25%" height="25px"&gt;value3&lt;/TD&gt;&lt;TD width="25%" height="25px"&gt;123ABC&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="25%" height="25px"&gt;value4&lt;/TD&gt;&lt;TD width="25%" height="25px"&gt;&lt;P&gt;ABC123&lt;/P&gt;&lt;P&gt;123ABC&lt;/P&gt;&lt;P&gt;AABBCC&lt;/P&gt;&lt;P&gt;12AB3C&lt;/P&gt;&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="25%" height="25px"&gt;value5&lt;/TD&gt;&lt;TD width="25%" height="25px"&gt;&lt;P&gt;ABC123&lt;/P&gt;&lt;P&gt;123ABC&lt;/P&gt;&lt;P&gt;AABBCC&lt;/P&gt;&lt;P&gt;12AB3C&lt;/P&gt;&lt;P&gt;CBA321&lt;/P&gt;&lt;/TD&gt;&lt;/TR&gt;&lt;/TBODY&gt;&lt;/TABLE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Hopefully that makes sense. Thanks&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Wed, 29 Jan 2025 04:45:22 GMT</pubDate>
    <dc:creator>rsAU</dc:creator>
    <dc:date>2025-01-29T04:45:22Z</dc:date>
    <item>
      <title>Counting unique values per session ID</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Counting-unique-values-per-session-ID/m-p/710078#M58071</link>
      <description>&lt;P&gt;I'm trying to count the unique values of a field by the common ID (session ID) but only once (one event). Each sessionID could have multiples of each unique field value.&lt;/P&gt;&lt;P&gt;Initially I was getting the count of every event which isn't what I want to count and if I 'dedup' the sessionID then I only get one of the unique field values back.&amp;nbsp;&lt;/P&gt;&lt;P&gt;Is it possible to count one event per session ID for each unique field value?&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;EM&gt;"stats values("field") by sessionID"&amp;nbsp;&lt;/EM&gt; gets me close but in the table it lists the sessionIDs whereas I'm hoping to get the number (count) of unique sessionIDs&amp;nbsp;&lt;/P&gt;&lt;TABLE border="1" width="33.333333333333336%"&gt;&lt;TBODY&gt;&lt;TR&gt;&lt;TD width="25%" height="25px"&gt;Field&lt;/TD&gt;&lt;TD width="25%" height="25px"&gt;sessionID&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="25%" height="25px"&gt;value1&lt;/TD&gt;&lt;TD width="25%" height="25px"&gt;&lt;P&gt;ABC123&lt;/P&gt;&lt;P&gt;123ABC&lt;/P&gt;&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="25%" height="25px"&gt;value2&lt;/TD&gt;&lt;TD width="25%" height="25px"&gt;ABC123&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="25%" height="25px"&gt;value3&lt;/TD&gt;&lt;TD width="25%" height="25px"&gt;123ABC&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="25%" height="25px"&gt;value4&lt;/TD&gt;&lt;TD width="25%" height="25px"&gt;&lt;P&gt;ABC123&lt;/P&gt;&lt;P&gt;123ABC&lt;/P&gt;&lt;P&gt;AABBCC&lt;/P&gt;&lt;P&gt;12AB3C&lt;/P&gt;&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="25%" height="25px"&gt;value5&lt;/TD&gt;&lt;TD width="25%" height="25px"&gt;&lt;P&gt;ABC123&lt;/P&gt;&lt;P&gt;123ABC&lt;/P&gt;&lt;P&gt;AABBCC&lt;/P&gt;&lt;P&gt;12AB3C&lt;/P&gt;&lt;P&gt;CBA321&lt;/P&gt;&lt;/TD&gt;&lt;/TR&gt;&lt;/TBODY&gt;&lt;/TABLE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Hopefully that makes sense. Thanks&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Wed, 29 Jan 2025 04:45:22 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Counting-unique-values-per-session-ID/m-p/710078#M58071</guid>
      <dc:creator>rsAU</dc:creator>
      <dc:date>2025-01-29T04:45:22Z</dc:date>
    </item>
    <item>
      <title>Re: Counting unique values per session ID</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Counting-unique-values-per-session-ID/m-p/710079#M58072</link>
      <description>&lt;P&gt;You question is a little confusing as the table shows the values of sessionID by field, which is what you say you wanted, but the stats is giving the values of field by sessionID, i.e. the other way round.&lt;/P&gt;&lt;P&gt;Are you looking for dc, i.e.&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| stats dc(sessionID) as uniqueSessionCount by field&lt;/LI-CODE&gt;&lt;P&gt;which would give you the count of different sessionIDs for each value of "field"&lt;/P&gt;</description>
      <pubDate>Wed, 29 Jan 2025 04:53:07 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Counting-unique-values-per-session-ID/m-p/710079#M58072</guid>
      <dc:creator>bowesmana</dc:creator>
      <dc:date>2025-01-29T04:53:07Z</dc:date>
    </item>
    <item>
      <title>Re: Counting unique values per session ID</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Counting-unique-values-per-session-ID/m-p/710101#M58076</link>
      <description>&lt;LI-CODE lang="markup"&gt;| stats dc(field) by sessionID&lt;/LI-CODE&gt;</description>
      <pubDate>Wed, 29 Jan 2025 09:18:16 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Counting-unique-values-per-session-ID/m-p/710101#M58076</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2025-01-29T09:18:16Z</dc:date>
    </item>
    <item>
      <title>Re: Counting unique values per session ID</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Counting-unique-values-per-session-ID/m-p/710204#M58088</link>
      <description>&lt;P&gt;Thanks - this is what I was after!&lt;/P&gt;&lt;P&gt;Yeah I was getting a list of every sessionId but I was trying to find a way to get a count of each unique ID.&amp;nbsp;&lt;/P&gt;&lt;P&gt;Cheers, Ryan&lt;/P&gt;</description>
      <pubDate>Wed, 29 Jan 2025 22:23:26 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Counting-unique-values-per-session-ID/m-p/710204#M58088</guid>
      <dc:creator>rsAU</dc:creator>
      <dc:date>2025-01-29T22:23:26Z</dc:date>
    </item>
  </channel>
</rss>

