I am trying to parse a syslog input to count the number of distinct IPs for a given country. My search string is
iplocation src_ip | stats sparkline count by Country | sort - count | head 10
I'd like to add a column after "count" that displays the number of unique source IP for a given country. Is this possible?
Maybe you can try this?
iplocation src_ip | stats sparkline count, dc(src_ip) by Country | sort - count | head 10
View solution in original post