Total amount of IPs

[fjurman001]

Hello.

I have this query:

index=XX | stats count by ipaddress

This creates a table which says how many log entries are there for each IP address, but what I need to know is How many different IP addresses are there. I don't care how many entries are there for each IP, I just need the total amount of different IP Addresses.

Any ideas?

Thanks in advance!
Regards,

[adonio · Accepted solution]

.... | stats dc(ipadress) as unique_ips ... ?

[wmyersas]

depending on use case (eg in a base search on a dashboard), you can also chain |stats thusly:

<search>
| stats count by ipaddress
| stats count

[fjurman001]

That was just what I needed!
Thank you very much!