topic Re: Display total count of unique values of a field in Splunk Search

Display total count of unique values of a field?

neerajs_81 — Fri, 16 Sep 2022 14:16:20 GMT

Hi, Fundamentals question but one of those brain teasers. How do i get a total count of distinct values of a field ? For example, as shown below Splunk shows my "aws_account_id" field has 100+ unique values. What is that exact 100+ number ? If i hover my mouse on the field, it shows Top 10 values etc. but not the total count.

Things i have tried as per other posts in the forum"

index=aws sourcetype="aws:cloudtrail" | fields aws_account_id | stats dc(count) by aws_account_id

This does show me the total count (which is 156) but it shows like this:

Instead i want the data in this tabular format:

Fieldname	Count
aws_account_id	156

Thanks in advance

Re: Display total count of unique values of a field

gcusello — Fri, 16 Sep 2022 06:31:34 GMT

Hi @neerajs_81,

to know how many different aws_account_id you have (result is a number) , you have to use the dc option in stats command:

index=aws sourcetype="aws:cloudtrail" | stats dc(aws_account_id) AS aws_account_id_count

Ciao.

Giuseppe

Re: Display total count of unique values of a field

isoutamo — Fri, 16 Sep 2022 07:19:28 GMT

that 100+ is not an exact number. It just show that this field have more than 100 different values (as you have count it is 156 in your case). One way to get your wanted output is

index=aws sourcetype="aws:cloudtrail" | fields aws_account_id | stats dc(count) as Count | eval Fieldname = "aws_account_id" | table Fieldname Count

r. Ismo

Re: Display total count of unique values of a field

gcusello — Fri, 16 Sep 2022 08:04:03 GMT

Hi @neerajs_81,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

Re: Display total count of unique values of a field

neerajs_81 — Fri, 16 Sep 2022 08:27:56 GMT

Thanks, karma points awarded.