I'm trying to find the number of unique IP address and user agent combinations while disregarding duplicates for a given time period. What would this search query look like?
As a rough thought, create a combined field concatenating IP and UA, then run a stats dc(field)
.
It might, just give it a shot.
I'm a bit of a newbie, would this search work?
host="podcast" | eval Uniques = IPAddress.UserAgent | stats dc(Uniques)