All Apps and Add-ons

Query to Find the Value in a Field Just One Time

JaysonD123
Explorer

Good Afternoon,

I am trying to figure out a way to iterate through a list whenever the value is counted one time. I'm hoping it'll make mq so that way my query is speedier. Here's my current query:

index=* eventtype IN(valueA,valueB,valueC) | stats count by eventtype

and the result looks like this:

eventtype                               count

valueA                                        102

valueB                                        407

valueC                                       1034

 

What I'd like is a query where if the query finds the value in the field one time, move on to find the next value. This is how I want the output to look like:

eventtype                               count

valueA                                        1

valueB                                        1

valueC                                       1

 

Any help would be appreciated.

Labels (1)
0 Karma
1 Solution

ITWhisperer
Legend
index=* eventtype IN(valueA,valueB,valueC) | dedup eventtype | stats count by eventtype

View solution in original post

JaysonD123
Explorer

This is close to what I was looking for. Thank you!

0 Karma

ITWhisperer
Legend
index=* eventtype IN(valueA,valueB,valueC) | dedup eventtype | stats count by eventtype

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!