https://community.splunk.com/t5/Splunk-Search/How-to-get-a-distinct-count-of-only-unique-values-of-a-field/m-p/439737#M125076 <P>So I'm trying to get a distinct count of source mac addresses by device. </P> <P>The srcmac gives me the mac address<BR /> The devtype gives me the type of device like Windows, Mac, Android etc. </P> <P>When I run the search below it gives a count of all events, it looks like where there's both a srcmac and a devtype. </P> <P>The problem is I only want to know the count of unique values for srcmac, so only unique mac addresses in this case. <BR /> How would I go about reformatting the search below to do this?</P> <PRE><CODE>| stats dc(srcmac) by devtype </CODE></PRE> Wed, 07 Aug 2019 22:12:44 GMT summitsplunk 2019-08-07T22:12:44Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-distinct-count-of-only-unique-values-of-a-field/m-p/439737#M125076 <P>So I'm trying to get a distinct count of source mac addresses by device. </P> <P>The srcmac gives me the mac address<BR /> The devtype gives me the type of device like Windows, Mac, Android etc. </P> <P>When I run the search below it gives a count of all events, it looks like where there's both a srcmac and a devtype. </P> <P>The problem is I only want to know the count of unique values for srcmac, so only unique mac addresses in this case. <BR /> How would I go about reformatting the search below to do this?</P> <PRE><CODE>| stats dc(srcmac) by devtype </CODE></PRE> Wed, 07 Aug 2019 22:12:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-distinct-count-of-only-unique-values-of-a-field/m-p/439737#M125076 summitsplunk 2019-08-07T22:12:44Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-distinct-count-of-only-unique-values-of-a-field/m-p/439738#M125077 <P>Hi summitsplunk,</P> <P>just try this:</P> <PRE><CODE> | stats dc(srcmac) </CODE></PRE> <P>this will give you a distinct count of <CODE>srcmac</CODE></P> <P>Hope this helps ...</P> <P>cheers, MuS</P> Wed, 07 Aug 2019 22:17:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-distinct-count-of-only-unique-values-of-a-field/m-p/439738#M125077 MuS 2019-08-07T22:17:04Z