https://community.splunk.com/t5/Splunk-Search/Distinct-count-limit-workaround/m-p/18892#M177225 <P>It will make it a bit less efficient but eventstats can make a first pass for you.</P> <PRE><CODE>Eventstats avg(field2) as f2 avg(field3) as f3 | stats first(f2) as f2 first(f3) as f3 count by field1 | stats count first(f2) as "avg field2" first(f3) as "avg field3" </CODE></PRE> Sat, 28 May 2011 16:05:56 GMT sideview 2011-05-28T16:05:56Z https://community.splunk.com/t5/Splunk-Search/Distinct-count-limit-workaround/m-p/18891#M177224 <P>So I use the following workaround to get over the 100k hurdle with distinct_count(field1)</P> <P>....| stats count by field1 | stats count</P> <P>However I need to include other metrics (field2, field3) in the same search. For example</P> <P>....| stats avg(field2) avg(field3)</P> <P>How can I compute all the three metrics in one search?</P> Sat, 28 May 2011 13:34:56 GMT https://community.splunk.com/t5/Splunk-Search/Distinct-count-limit-workaround/m-p/18891#M177224 nbharadwaj 2011-05-28T13:34:56Z https://community.splunk.com/t5/Splunk-Search/Distinct-count-limit-workaround/m-p/18892#M177225 <P>It will make it a bit less efficient but eventstats can make a first pass for you.</P> <PRE><CODE>Eventstats avg(field2) as f2 avg(field3) as f3 | stats first(f2) as f2 first(f3) as f3 count by field1 | stats count first(f2) as "avg field2" first(f3) as "avg field3" </CODE></PRE> Sat, 28 May 2011 16:05:56 GMT https://community.splunk.com/t5/Splunk-Search/Distinct-count-limit-workaround/m-p/18892#M177225 sideview 2011-05-28T16:05:56Z https://community.splunk.com/t5/Splunk-Search/Distinct-count-limit-workaround/m-p/18893#M177226 <P>I believe that limit has been removed as of version 4.2, so I think if you can upgrade, you can get around it easily that way.</P> Mon, 30 May 2011 00:43:04 GMT https://community.splunk.com/t5/Splunk-Search/Distinct-count-limit-workaround/m-p/18893#M177226 gkanapathy 2011-05-30T00:43:04Z