I'm trying to count the unique values of a field by the common ID (session ID) but only once (one event). Each sessionID could have multiples of each unique field value. Initially I was getting the count of every event which isn't what I want to count and if I 'dedup' the sessionID then I only get one of the unique field values back.  Is it possible to count one event per session ID for each unique field value?  "stats values("field") by sessionID"  gets me close but in the table it lists the sessionIDs whereas I'm hoping to get the number (count) of unique sessionIDs  Field sessionID value1 ABC123 123ABC value2 ABC123 value3 123ABC value4 ABC123 123ABC AABBCC 12AB3C value5 ABC123 123ABC AABBCC 12AB3C CBA321   Hopefully that makes sense. Thanks   ... View more

I want to count user_ids that appear more than once per month. (ie a user that has used the product multiple times).  I've tried a few variations such as : search XXX | dedup XXX | stats count by user_id | where count >1 but can't seem to get it to work. Hoping to be able to display the count as a single number as well as timechart it so I can show the number over the last X months.. Any suggestions? It feels like it should've been easier than it has been! ... View more