- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to get a distinct count of only unique values of a field

summitsplunk
Communicator
08-07-2019
03:12 PM
So I'm trying to get a distinct count of source mac addresses by device.
The srcmac gives me the mac address
The devtype gives me the type of device like Windows, Mac, Android etc.
When I run the search below it gives a count of all events, it looks like where there's both a srcmac and a devtype.
The problem is I only want to know the count of unique values for srcmac, so only unique mac addresses in this case.
How would I go about reformatting the search below to do this?
| stats dc(srcmac) by devtype
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

MuS
Legend
08-07-2019
03:17 PM
Hi summitsplunk,
just try this:
| stats dc(srcmac)
this will give you a distinct count of srcmac
Hope this helps ...
cheers, MuS
