Does this do what you need? index=proxy | eventstats dc(user) as unique_users by url | top url | sort 5 - count | table url, unique_users, count, percent ... View more