My Query:
index=blah sourcetype="blah-2" | dedup User_IP
This works by extracting the unique IP's defined by the field User_IP, and the eventcount at the top of the search returns a total of say "395". What I want it to do is actually spit out the number within the search results so I can add this to a dashboard.
I can't for the life of me find the correct command to do so.
Thanks in advance!
