Splunk Search

How to edit my inputlookup search to find the count of unique values of FieldA per FieldB?

HattrickNZ
Motivator

I have the following search

| inputlookup msckpr_test_trunkgroups95_lookup_define | stats values(TG_NAME) as TG_NAMES dc(TG_NAMES) by CATEGORY

this gives a single field value in CATEGORY and multiple field values in TG_NAMES per CATEGORY.

*Now I want to be able to count the unique number of field values in the TG_NAMES per CATEGORY, how do i do this? *

I have treid using something like dc(TG_NAMES) but this is just giving me 0 fir each CATEGORY

Tags (3)
0 Karma

jmheaton
Path Finder

Try this

|inputlookup msckpr_test_trunkgroups95_lookup_define | stats values(TG_Name) as Values by CATEGORY | stats dc(Values) by CATEGORY

0 Karma

HattrickNZ
Motivator

nope does not work. dc(Values) are all 0

0 Karma

HattrickNZ
Motivator

this works | inputlookup msckpr_test_trunkgroups95_lookup_define | stats count(TG_NAME) as TG_NAMES by CATEGORY but i loose the TG_NAMES values

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...