Splunk Search

How to get distinct values of one field by another field

sridamg
Explorer

the below search will give me distinct count of one field by another field

some search | stats dc(field1) by field2

but how would I get the distinct values for field1 by field2

so i want something like below:

some search | stats distinct(field1) by field2

Tags (3)
0 Karma

pradeepkumarg
Influencer

Check if this helps..

... | dedup field1, field2 | stats list(field1) by field2

MuS
Legend

Hi sridamg,

try something like this:

some search | stats values(field1) by field2

see the docs for more information http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/CommonStatsFunctions

cheers, MuS

Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...