Hello.
I have this query:
index=XX | stats count by ipaddress
This creates a table which says how many log entries are there for each IP address, but what I need to know is How many different IP addresses are there. I don't care how many entries are there for each IP, I just need the total amount of different IP Addresses.
Any ideas?
Thanks in advance!
Regards,
.... | stats dc(ipadress) as unique_ips ...
?
depending on use case (eg in a base search on a dashboard), you can also chain |stats
thusly:
<search>
| stats count by ipaddress
| stats count
That was just what I needed!
Thank you very much!