How to achieve distinct count across multiple fields?

[robert2138]

How to get a distinct count across two different fields. I have webserver request logs containing browser family and IP address – so should be able to get a count of different & distinct user-browsers by browser family – i.e. how many different users are using Safari for example. But piping into:

stats dc(ua_family,cp_ip) by ua_family

… doesn’t do it - I get a distinct list of browser families but zero counts. But concatenating the fields:

eval comb=c_ip.ua_family | stats dc(comb) by ua_family

…does work. Is there a way to do it without concatenating?
So why didn’t the dc on the two separate fields work?

[nick405060]

Credit goes to @micahkemp:

| stats dc(eval(mvappend(field1, field2, field3)))

[weezeee]

Not sure if it helps but in my case, I have some stats that require me to look at combination of clients services, and the intersection (some clients are using some services, but not others). I needed to do some stats for distinct client, service, and the client-service contracts. My raw data already have the field of each transaction with name of the client and service they have. I can get that by creating a new field, CONTRACT, which is simply a concatenation of client and service, then I can do a distinct count on it:

| stats count by CLIENT SERVICE | eval CONTRACT = CLIENT . "-" . SERVICE | stats dc(SERVICE) dc(CLIENT) dc(CONTRACT)

[gfuente]

Hello

You could use dedup to get only 1 event per combination of user agent and ip and then make a regular count:

... | dedup ua_family cp_ip | stats count

Regards

[gkanapathy · Accepted solution]

i am not actually sure what you are asking to count, but either ... | stats dc(c_ip) by ua_family or ... | stats count by ua_family,c_ip may be what you want. if not, perhaps you could clarify as i don't think i understand what you're looking for.

[linu1988]

May be dc doesn't work on multiple fields..

you can get it like this:
| stats distinct_count(ua_family) ua_ip dd by ua_family,cp_ip|stats count(ua_ip)