# Graph to show me where many-to-one occurs **URL:** \ **Category:** Kibana\ **Created:** [August 29, 2018, 4:31pm UTC](https://discuss.elastic.co/t/graph-to-show-me-where-many-to-one-occurs/146561 "2018-08-29T16:31:49Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![jclose](https://avatars.discourse-cdn.com/v4/letter/j/df705f/32.png) [@jclose](https://discuss.elastic.co/u/jclose)\ **Post date:** [August 29, 2018, 4:31pm UTC](https://discuss.elastic.co/t/graph-to-show-me-where-many-to-one-occurs/146561/1 "2018-08-29T16:31:49Z")
I want to have a graph that shows me where multiple account names are coming from a single IP. So I have all of these log lines where I have an account name and an IP. How can I see a graph that will show me the largest IPs that have multiple account names? Not the highest count for an IP, because I don't care if a single account logs in from a single IP 100 times. What I care about is if a single IP has a hundred accounts logging in from that IP. I don't quite understand what subaggregations to make. And what would this kind of query be called? It's kind of a many-to-one thing. ---
**Author:** ![Larry\_Gregory](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/larry_gregory/32/34969_2.png) [@Larry\_Gregory](https://discuss.elastic.co/u/Larry_Gregory)\ **Post date:** [August 30, 2018, 12:07pm UTC](https://discuss.elastic.co/t/graph-to-show-me-where-many-to-one-occurs/146561/2 "2018-08-30T12:07:42Z")
Hey @jclose It sounds like you're looking for a "Unique Count" aggregation. Here's a sample bar chart that I threw together to illustrate: ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/5/c53e8dd6b2e6ff182291f63efdecbc013e0df8ba.png) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 27, 2018, 12:17pm UTC](https://discuss.elastic.co/t/graph-to-show-me-where-many-to-one-occurs/146561/3 "2018-09-27T12:17:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.