I have the following search
| inputlookup msckpr_test_trunkgroups95_lookup_define | stats values(TG_NAME) as TG_NAMES dc(TG_NAMES) by CATEGORY
this gives a single field value in CATEGORY and multiple field values in TG_NAMES per CATEGORY.
*Now I want to be able to count the unique number of field values in the TG_NAMES per CATEGORY, how do i do this? *
I have treid using something like dc(TG_NAMES) but this is just giving me 0 fir each CATEGORY
Try this
|inputlookup msckpr_test_trunkgroups95_lookup_define | stats values(TG_Name) as Values by CATEGORY | stats dc(Values) by CATEGORY
nope does not work. dc(Values) are all 0
this works | inputlookup msckpr_test_trunkgroups95_lookup_define | stats count(TG_NAME) as TG_NAMES by CATEGORY but i loose the TG_NAMES values