I have the following search
| inputlookup msckpr_test_trunkgroups95_lookup_define | stats values(TG_NAME) as TG_NAMES dc(TG_NAMES) by CATEGORY
this gives a single field value in CATEGORY
and multiple field values in TG_NAMES
per CATEGORY
.
*Now I want to be able to count the unique number of field values in the TG_NAMES
per CATEGORY
, how do i do this? *
I have treid using something like dc(TG_NAMES)
but this is just giving me 0
fir each CATEGORY
Try this
|inputlookup msckpr_test_trunkgroups95_lookup_define | stats values(TG_Name) as Values by CATEGORY | stats dc(Values) by CATEGORY
nope does not work. dc(Values) are all 0
this works | inputlookup msckpr_test_trunkgroups95_lookup_define | stats count(TG_NAME) as TG_NAMES by CATEGORY
but i loose the TG_NAMES
values