Splunk Search

How do I get a unique count with my query?

lyonsbm
New Member

Below is a query that I am able to get a list of accounts, and the total times they each have been received.

How can I modify so that I only get a count of unique account numbers?

This query gives me a list of accounts and how many times they are seen, I want to only see each account once and only a count, nothing more.

index="prd" "PassiveReceiver" PID_3="*" |top PID_3 limit=0

Any help would be greatly appreciated!!

Tags (2)
0 Karma

woodcock
Esteemed Legend

Literally, like this:

index="prd" "PassiveReceiver" PID_3="*"
| stats dc(PID_3)

But better:

index="prd" "PassiveReceiver" PID_3="*"
| stats count BY PID_3
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try stats.

index="prd" "PassiveReceiver" PID_3="*" | stats count by PID_3
---
If this reply helps you, Karma would be appreciated.
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @lyonsbm,
did you tried something like this?

index="prd" "PassiveReceiver" PID_3="*" 
| stats count BY PID_3

or using your search

index="prd" "PassiveReceiver" PID_3="*" 
| top PID_3 limit=0
| table PID_3 count

Ciao.
Giuseppe

0 Karma

rupeshn
Explorer

You can try this,

index="prd" "PassiveReceiver" PID_3="*" |stats count by PID_3

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...