How to count distinct IPs from a given country

[mlines333]

I am trying to parse a syslog input to count the number of distinct IPs for a given country. My search string is

 iplocation src_ip | stats sparkline count by Country | sort - count | head 10

I'd like to add a column after "count" that displays the number of unique source IP for a given country. Is this possible?

[willemjongeneel · Accepted solution]

Hello,

Maybe you can try this?

iplocation src_ip | stats sparkline count, dc(src_ip) by Country | sort - count | head 10

Kind regards,
Willem