I have this search and I want only the unique count. I'm getting the unique count for the id field, but not for Permit and Deny How can I fix my search to get the unique count for Permit and Deny?
| stats dc(id), count(eval(_raw LIKE "%Permit%")) as "Permit" , count(eval(_raw LIKE "%Deny%")) as "Deny" by username
thanks,
To count only unique Permit and Deny strings, use dc
instead of count
.
| stats dc(id), dc(eval(_raw LIKE "%Permit%")) as "Permit" , dc(eval(_raw LIKE "%Deny%")) as "Deny" by username
To count only unique Permit and Deny strings, use dc
instead of count
.
| stats dc(id), dc(eval(_raw LIKE "%Permit%")) as "Permit" , dc(eval(_raw LIKE "%Deny%")) as "Deny" by username