How do I get a unique count with my query?

[lyonsbm]

Below is a query that I am able to get a list of accounts, and the total times they each have been received.

How can I modify so that I only get a count of unique account numbers?

This query gives me a list of accounts and how many times they are seen, I want to only see each account once and only a count, nothing more.

index="prd" "PassiveReceiver" PID_3="*" |top PID_3 limit=0

Any help would be greatly appreciated!!

[woodcock]

Literally, like this:

index="prd" "PassiveReceiver" PID_3="*"
| stats dc(PID_3)

But better:

index="prd" "PassiveReceiver" PID_3="*"
| stats count BY PID_3

[richgalloway]

Try stats.

index="prd" "PassiveReceiver" PID_3="*" | stats count by PID_3

[gcusello]

Hi @lyonsbm,
did you tried something like this?

index="prd" "PassiveReceiver" PID_3="*" 
| stats count BY PID_3

or using your search

index="prd" "PassiveReceiver" PID_3="*" 
| top PID_3 limit=0
| table PID_3 count

Ciao.
Giuseppe

[rupeshn]

You can try this,

index="prd" "PassiveReceiver" PID_3="*" |stats count by PID_3