- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
earriaga
Path Finder
11-09-2022
09:25 AM
I have a working search that uses a look up, that is like this:
index=MyIndex
[| inputlookup MyCSVFile
| stats values(email) AS EmailAddress
| format]
|chart count(Code) as NumCodes over EmailAddress |sort -NumCodes
This works, but there are duplicate codes, so i want the search to count only unique codes per user.
I am not sure how to say Count Unique.
Thank you for your help!!
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust
11-09-2022
10:58 AM
Splunk uses "distinct_count" for Count Unique.
index=MyIndex
[| inputlookup MyCSVFile
| stats values(email) AS EmailAddress
| format]
| chart distinct_count(Code) as NumCodes over EmailAddress
| sort - NumCodes
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust
11-09-2022
10:58 AM
Splunk uses "distinct_count" for Count Unique.
index=MyIndex
[| inputlookup MyCSVFile
| stats values(email) AS EmailAddress
| format]
| chart distinct_count(Code) as NumCodes over EmailAddress
| sort - NumCodes
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
