https://community.splunk.com/t5/Splunk-Search/Using-the-dedup-command/m-p/669388#M229595 <P>Use the <FONT face="courier new,courier">distinct_count</FONT> function of the <FONT face="courier new,courier">stats</FONT> command.</P><LI-CODE lang="markup">| stats dc(recip) as recip_count by attachment_type</LI-CODE> Tue, 21 Nov 2023 19:59:10 GMT richgalloway 2023-11-21T19:59:10Z https://community.splunk.com/t5/Splunk-Search/Using-the-dedup-command/m-p/669382#M229593 <P><SPAN>How do I count the number of unique recipients of each type of unique attachment from emails. The same user could receive the same attachment in multiple emails. Using the “dedup” command?</SPAN></P> Tue, 21 Nov 2023 18:55:04 GMT https://community.splunk.com/t5/Splunk-Search/Using-the-dedup-command/m-p/669382#M229593 Benny611 2023-11-21T18:55:04Z https://community.splunk.com/t5/Splunk-Search/Using-the-dedup-command/m-p/669388#M229595 <P>Use the <FONT face="courier new,courier">distinct_count</FONT> function of the <FONT face="courier new,courier">stats</FONT> command.</P><LI-CODE lang="markup">| stats dc(recip) as recip_count by attachment_type</LI-CODE> Tue, 21 Nov 2023 19:59:10 GMT https://community.splunk.com/t5/Splunk-Search/Using-the-dedup-command/m-p/669388#M229595 richgalloway 2023-11-21T19:59:10Z https://community.splunk.com/t5/Splunk-Search/Using-the-dedup-command/m-p/669510#M229616 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>&nbsp;Thanks, it worked, and I appreciate it.</P> Wed, 22 Nov 2023 17:52:27 GMT https://community.splunk.com/t5/Splunk-Search/Using-the-dedup-command/m-p/669510#M229616 Benny611 2023-11-22T17:52:27Z