# How to create a visualization based on a unique count of an IP field but excluding port number? **URL:** \ **Category:** Kibana\ **Created:** [November 13, 2024, 10:38am UTC](https://discuss.elastic.co/t/how-to-create-a-visualization-based-on-a-unique-count-of-an-ip-field-but-excluding-port-number/370470 "2024-11-13T10:38:36Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Silvy20](https://avatars.discourse-cdn.com/v4/letter/s/b4bc9f/32.png) [@Silvy20](https://discuss.elastic.co/u/Silvy20)\ **Post date:** [November 13, 2024, 10:38am UTC](https://discuss.elastic.co/t/how-to-create-a-visualization-based-on-a-unique-count-of-an-ip-field-but-excluding-port-number/370470/1 "2024-11-13T10:38:36Z")
Hello, I need to create a visualization based on unique count of IPs, however the field available in kibana is in the following format: xx.xx.xx.xx:xxxx I would like to know if through formulas (fe) I have a way to calculate the unique count fo the IPs but excluding the last part ":xxxx". Thanks in advance. ---
**Author:** ![GinkoLucas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ginkolucas/32/107055_2.png) [@GinkoLucas](https://discuss.elastic.co/u/GinkoLucas)\ **Post date:** [November 13, 2024, 1:05pm UTC](https://discuss.elastic.co/t/how-to-create-a-visualization-based-on-a-unique-count-of-an-ip-field-but-excluding-port-number/370470/2 "2024-11-13T13:05:25Z")
Hi, I don't know if there's a perfect solution, but you could create a new field containing the ip in the format you want. I have two solutions in mind: - Use a Runtime Field ([Runtime fields | Elasticsearch Guide [8.16] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/runtime.html#:~:text=A%20runtime%20field%20is%20a,without%20understanding%20how%20it's%20structured)) - Extract the part you're interested in using a Grok processor in an ingest Pipeline ([Grok processor | Elasticsearch Guide [8.16] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/grok-processor.html))