Thanks for the suggestion, I've tried some similar queries to this but the result is the same. So when I run this query as you suggested, the Total for one particular host comes out to 359, but if I go and simply grep the string I come up with 439 matches. If I drill down into the results, I can see that the string I'm looking for is highlighted twice in one single event, and the count is the number of events, not the unique number of strings.
I'm still reading through the documentation here and I'm assuming the issue might be that I don't want events grouped up, I'd want them separated by line number. I've been searching around for a query that will return a unique number of strings but it always seems to count events like this.
... View more
