Kibana data normalization

[47bit (Ilya Ayupov)]

I have a dataset that contains data like this:
IP, event type, ...
IP1, EventType1, ...
IP2, EventType2, ...
IP1, EventType2, ...
IP1, EventType1, ...
IP3, EventType2, ...

I want to show count events of every event but I want to normalize metric by count of unique IP for this event type(count(event type=EventTypen)/count(uniqueIP(event type=EventTypen)). Can I do this?

[jsanz (Jorge Sanz)]

Lens supports the unique.count function that does exactly what you want, and can be used in a formula.

In the screenshot below, using the Kibana Flights dataset, I create a Lens table that shows for each Carrier the count of destinations, the unique count of destination countries, and the normalized value with those two (not looking for any meaningful value here, just to show how it works)