https://community.splunk.com/t5/Splunk-Search/How-to-distinct-count-and-separate-by-type/m-p/133786#M36551 <P>You can disregard this, I was simply using "Eventtype=*" as a place holder for the search. You probably want a search closer to the following.</P> <PRE><CODE>index="raw_internet" produto="1" pessoa="F" date_hour!=0 | eventstats dc(user) as userCount | dedup user, tipo | table user, tipo, userCount </CODE></PRE> Tue, 02 Jun 2015 18:25:32 GMT Thomas_Aneiro 2015-06-02T18:25:32Z https://community.splunk.com/t5/Splunk-Search/How-to-distinct-count-and-separate-by-type/m-p/133781#M36546 <P>I need to make a distinct count of clients and together count what clients had at least one error message?</P> <P>I have client code, and type success, warning and error, and the same client makes multiple transactions, so i need to count how many distinct clients i have, and if this distinct clients had some error, count only one error per client. I don´t want to use append to keep my search light. Any suggestions?</P> <P>stats distinct_count(eval(clientcode)) as UniqueClient...</P> Tue, 02 Jun 2015 17:39:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-distinct-count-and-separate-by-type/m-p/133781#M36546 vitorvmiguel 2015-06-02T17:39:52Z https://community.splunk.com/t5/Splunk-Search/How-to-distinct-count-and-separate-by-type/m-p/133782#M36547 <P>Can you post a sample event? At present, it looks like the <CODE>eval</CODE> in <CODE>count</CODE> is unnecessary.</P> Tue, 02 Jun 2015 17:49:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-distinct-count-and-separate-by-type/m-p/133782#M36547 aljohnson_splun 2015-06-02T17:49:15Z https://community.splunk.com/t5/Splunk-Search/How-to-distinct-count-and-separate-by-type/m-p/133783#M36548 <P>Would something like this work for you?</P> <PRE><CODE>eventtype=* | eventstats dc(user) as userCount | dedup user, error | table user, error, userCount </CODE></PRE> Tue, 02 Jun 2015 18:05:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-distinct-count-and-separate-by-type/m-p/133783#M36548 Thomas_Aneiro 2015-06-02T18:05:56Z https://community.splunk.com/t5/Splunk-Search/How-to-distinct-count-and-separate-by-type/m-p/133784#M36549 <P>I don´t have any sample, because i´ve tested a ton of functions and none of them took the desirable result, here is my actual querie searching only the disctinct clients, so beside that i have a field type that has 3 possible values E (Error), W (Warning) and I (Success), so i need to filter inside those unique clients who faced an error.</P> <P>index="raw_internet" produto="1" pessoa="F" date_hour!=0 | stats distinct_count(codigoAcesso) as ClientesUnicos</P> Mon, 28 Sep 2020 20:07:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-distinct-count-and-separate-by-type/m-p/133784#M36549 vitorvmiguel 2020-09-28T20:07:20Z https://community.splunk.com/t5/Splunk-Search/How-to-distinct-count-and-separate-by-type/m-p/133785#M36550 <P>What is this eventtype=* ? My event field is called "tipo", and its possible values are Error, Success, Warning</P> Tue, 02 Jun 2015 18:22:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-distinct-count-and-separate-by-type/m-p/133785#M36550 vitorvmiguel 2015-06-02T18:22:31Z https://community.splunk.com/t5/Splunk-Search/How-to-distinct-count-and-separate-by-type/m-p/133786#M36551 <P>You can disregard this, I was simply using "Eventtype=*" as a place holder for the search. You probably want a search closer to the following.</P> <PRE><CODE>index="raw_internet" produto="1" pessoa="F" date_hour!=0 | eventstats dc(user) as userCount | dedup user, tipo | table user, tipo, userCount </CODE></PRE> Tue, 02 Jun 2015 18:25:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-distinct-count-and-separate-by-type/m-p/133786#M36551 Thomas_Aneiro 2015-06-02T18:25:32Z https://community.splunk.com/t5/Splunk-Search/How-to-distinct-count-and-separate-by-type/m-p/133787#M36552 <P>Lots of ways to do this.</P> <P>| eval is_not_success=if(match(type,"I"),0,1)<BR /> | stats sum(is_not_success) AS error_warn_count by clientcode<BR /> | stats count AS TotalDistinctClients, count(eval(error_warn_count&gt;0)) AS DistinctClientsWithErrors</P> <P>Apologies about the weird negation on "is_not_success" but it is necessary for the "sum".</P> Mon, 28 Sep 2020 20:07:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-distinct-count-and-separate-by-type/m-p/133787#M36552 jacobwilkins 2020-09-28T20:07:23Z https://community.splunk.com/t5/Splunk-Search/How-to-distinct-count-and-separate-by-type/m-p/133788#M36553 <P>It worked! Thanks</P> Wed, 03 Jun 2015 15:28:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-distinct-count-and-separate-by-type/m-p/133788#M36553 vitorvmiguel 2015-06-03T15:28:26Z