How do I get unique values from a field with a given search in kibana

Elastic Stack Kibana
1

If I have a given search:
eventType:DeviceRequestResponseEvent
AND (exists:payload.cattle.name)
AND DoorId:1bf35dbc-ce2b-4a2c-b126-7cd531aa84ad
AND payload.deviceRequestResponseEvent.payloadType:COMMAND_REQUEST_TYPE
AND NOT payload.deviceRequestResponseEvent.responseCode:SUCCESS

And I want to find the unique values of a field, example below, not in the search above:
payload.deviceRequestResponseEvent.responseCode

So the values from payload.deviceRequestResponseEvent.responseCode might be
abc
def
ghi

How do I do this in kibana or in the serach part of kibana

2

2 steps that should get what you want;

  1. Setup a filter with those terms
  2. Use a terms aggregation on that field, with a unique metric

This will likely be best displayed as a table.

3

tks, but
I add my search in kibana -> discover
Then I add my filter with field name payload.deviceRequestResponseEvent.responseCode
but this only allows me to filter on field and there is an operator but this include "is, isnot ...exists"but there is no unique operator.

In the edit filter there is a edit as query DSL, maybe i can write a script there, tho not familiar with that language.

Maybe you are referring to the create viualisation, which I have created a table in there, which I have worked out how to get the unique values of a field but that is just on the field, I can't apply a search/filter before getting the unique values of a chosen field. tks

4

You need to create a visualisation, usually in a dashboard. Discover is only for filtering as you have found.

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.