Below is a query that I am able to get a list of accounts, and the total times they each have been received.
How can I modify so that I only get a count of unique account numbers?
This query gives me a list of accounts and how many times they are seen, I want to only see each account once and only a count, nothing more.
index="prd" "PassiveReceiver" PID_3="*" |top PID_3 limit=0
Any help would be greatly appreciated!!
Literally, like this:
index="prd" "PassiveReceiver" PID_3="*"
| stats dc(PID_3)
But better:
index="prd" "PassiveReceiver" PID_3="*"
| stats count BY PID_3
Try stats
.
index="prd" "PassiveReceiver" PID_3="*" | stats count by PID_3
Hi @lyonsbm,
did you tried something like this?
index="prd" "PassiveReceiver" PID_3="*"
| stats count BY PID_3
or using your search
index="prd" "PassiveReceiver" PID_3="*"
| top PID_3 limit=0
| table PID_3 count
Ciao.
Giuseppe
You can try this,
index="prd" "PassiveReceiver" PID_3="*" |stats count by PID_3