Splunk Search

How to edit my inputlookup search to find the count of unique values of FieldA per FieldB?

HattrickNZ
Motivator

I have the following search

| inputlookup msckpr_test_trunkgroups95_lookup_define | stats values(TG_NAME) as TG_NAMES dc(TG_NAMES) by CATEGORY

this gives a single field value in CATEGORY and multiple field values in TG_NAMES per CATEGORY.

*Now I want to be able to count the unique number of field values in the TG_NAMES per CATEGORY, how do i do this? *

I have treid using something like dc(TG_NAMES) but this is just giving me 0 fir each CATEGORY

Tags (3)
0 Karma

jmheaton
Path Finder

Try this

|inputlookup msckpr_test_trunkgroups95_lookup_define | stats values(TG_Name) as Values by CATEGORY | stats dc(Values) by CATEGORY

0 Karma

HattrickNZ
Motivator

nope does not work. dc(Values) are all 0

0 Karma

HattrickNZ
Motivator

this works | inputlookup msckpr_test_trunkgroups95_lookup_define | stats count(TG_NAME) as TG_NAMES by CATEGORY but i loose the TG_NAMES values

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...