Display total count of unique values of a field?

[neerajs_81]

Hi,   Fundamentals question but one of those brain teasers.  How do i get a total count of distinct values of a field ?   For example, as shown below  Splunk shows my "aws_account_id" field has 100+ unique values.   What is that exact 100+ number ?  If i hover my mouse on the field, it shows Top 10 values etc. but not the total count. 

Things i have tried as per other posts in the forum"

index=aws sourcetype="aws:cloudtrail" | fields aws_account_id 
| stats dc(count) by aws_account_id 

 
This does show me the total count (which is 156) but it shows like this:

Instead i want the data in this tabular format:

Fieldname	Count
aws_account_id	156

Thanks in advance

[isoutamo]

Hi

that 100+ is not an exact number. It just show that this field have more than 100 different values (as you have count it is 156 in your case). One way to get your wanted output is

index=aws sourcetype="aws:cloudtrail" 
| fields aws_account_id 
| stats dc(count) as Count 
| eval Fieldname = "aws_account_id"
| table Fieldname Count

r. Ismo

[neerajs_81]

Thanks, karma points awarded. 

[gcusello · Accepted solution]

Hi @neerajs_81,

to know how many different aws_account_id you have (result is a number) , you have to use the dc option in stats command:

index=aws sourcetype="aws:cloudtrail" 
| stats dc(aws_account_id) AS aws_account_id_count

Ciao.

Giuseppe

[gcusello]

Hi @neerajs_81,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉