So I'm trying to get a distinct count of source mac addresses by device.
The srcmac gives me the mac address
The devtype gives me the type of device like Windows, Mac, Android etc.
When I run the search below it gives a count of all events, it looks like where there's both a srcmac and a devtype.
The problem is I only want to know the count of unique values for srcmac, so only unique mac addresses in this case.
How would I go about reformatting the search below to do this?
| stats dc(srcmac) by devtype
just try this:
| stats dc(srcmac)
this will give you a distinct count of srcmac
Hope this helps ...