Kibana Distinct Count

Elastic Stack Kibana
1

I am using Elastic with Kibana. What is the best way to get a Distinct count ?

I want effectively a "distinct count of IP by Account"

2

Hi @dfir

you can create a new visualization (from a dashboard) and select the Table chart type, then configure a Top values of Account and Unique count of IP

3

I tried that but I was getting errors because the data I have ingested in my index is over a size limit.

Is there no way to do this like splunk in search and create a table?

image

4

Interesting, that sounds like a big amount of data.
I mean you can try the ESQL version, but that would limit the results to the first 10000k rows:

  • open Discover and from the top right pick Language: ES|QL (or Try ES|QL) depending on your stack version
  • type something like FROM your_index | STATS count_distinct( ip ) BY account
5

I do not see any option to pick a language.

the query did not work either. I am on Version 8.7.1 at the moment.

6

ES|QL has been introduced with stack version 8.11, but if you need to upgrade I'd recommend to go to 8.13.