Distinct values

[SplnkUse]

Hello

I am running a * search in an app and it returns several columns in the csv extract where a column is named 'source'.

I want to return the distinct values of 'source' but neither of the below work:

| values(source)

or

| distinct source

Any idea?

thanks!

[yuanliu · Accepted solution]

---

I want to return the distinct values of 'source' but neither of the below work:

| values(source)

or

| distinct source

values and distinct  are not  commands.  Have you tried stats?

| stats values(source) dc(source)

[ITWhisperer]

| dedup source