How do I get distinct values for a derived field in a search?

[wwhitener]

Good afternoon all,

I have a datasource that I've used transforms.conf and props.conf to create a "field" derived from a comma-delimited portion of each event. How do I get a list of the distinct values?

For example, if I have three events:

[A, B, C, D]

[D, E, F, G]

[A, G, C, Z]

How do I get a resultset that gives me "A", "B", "C", "D", "E", "F", "G", "Z" and no counts or any other information?

I already have the transforms.conf and props.conf pulling out the values for the "tags", but not a way to say "Here are all of the values for that field". In SQL, I'd use "SELECT DISTINCT TEXT FROM MYTAGS...", but I don't know about the Splunk query values.

[Ayn · Accepted solution]

http://docs.splunk.com/Documentation/Splunk/4.2.2/SearchReference/CommonStatsFunctions

values(X)   This function returns the list of all distinct values of the field X as a multi-value entry. The order of the values is lexicographical. 

So if the values in your example are extracted as a multi-valued field called, say, "foo", you would do something like:

... | stats values(foo)

[wwhitener]

I guess I went the wrong way around it then.
source="mysource.log" | stats count by myfield | fields myfield
It was to populate a form dropdown, so ultimately even the "fields" functions is not really needed for what I wanted.
Thanks for the answer! I'll try it your way too.