Find values for specific distinct counts

[mztopp]

Hello all!

I was hoping to take a distinct count and show either the count, or if the count is 1, show the value that is being counted. For example, index=random | stats dc(src_port) AS port_count count by src_ip would populate:

src_ip    |      port_count

-----------------------------------------------------

1.2.3.4             6

2.3.4.5             (1) Port 443

3.4.5.6              4

Or something to this effect. Thanks!

[richgalloway · Accepted solution]

There may be a few ways to do that.  Here's one.

index=random 
| stats values(src_port) AS ports count by src_ip 
| eval port_count = if(mvcount(ports)==1,"(1) Port " . mvindex(ports,0), mvcount(ports))

[mztopp]

Thank you!