Splunk Search

How to edit my inputlookup search to find the count of unique values of FieldA per FieldB?

HattrickNZ
Motivator

I have the following search

| inputlookup msckpr_test_trunkgroups95_lookup_define | stats values(TG_NAME) as TG_NAMES dc(TG_NAMES) by CATEGORY

this gives a single field value in CATEGORY and multiple field values in TG_NAMES per CATEGORY.

*Now I want to be able to count the unique number of field values in the TG_NAMES per CATEGORY, how do i do this? *

I have treid using something like dc(TG_NAMES) but this is just giving me 0 fir each CATEGORY

Tags (3)
0 Karma

jmheaton
Path Finder

Try this

|inputlookup msckpr_test_trunkgroups95_lookup_define | stats values(TG_Name) as Values by CATEGORY | stats dc(Values) by CATEGORY

0 Karma

HattrickNZ
Motivator

nope does not work. dc(Values) are all 0

0 Karma

HattrickNZ
Motivator

this works | inputlookup msckpr_test_trunkgroups95_lookup_define | stats count(TG_NAME) as TG_NAMES by CATEGORY but i loose the TG_NAMES values

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...