Finding the number of unique ip-addresses per country using geostats

[jledinh]

So what I have been able to do is display the total event count in each country/region using

host="NC-CORP-3098-AccessLogs" | iplocation clientip| geostats globallimit=0 count by Country

Is there a way to display the number of unique ip-addresses in each country?

[DMohn · Accepted solution]

As geostats uses the same stats aggregations as regular stats, dc would be the command you are looking for:

host="NC-CORP-3098-AccessLogs" | iplocation clientip| geostats globallimit=0 dc(clientip) as "Unique IP adresses" by Country

[jledinh]

Thank you so much!