# Kibana Distinct Count

**URL:** <https://discuss.elastic.co/t/kibana-distinct-count/360727>\
**Category:** Kibana\
**Created:** [June 3, 2024, 2:59pm UTC](https://discuss.elastic.co/t/kibana-distinct-count/360727 "2024-06-03T14:59:35Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![dfir](https://avatars.discourse-cdn.com/v4/letter/d/76d3ee/32.png) [@dfir](https://discuss.elastic.co/u/dfir)\
**Post date:** [June 3, 2024, 2:59pm UTC](https://discuss.elastic.co/t/kibana-distinct-count/360727/1 "2024-06-03T14:59:35Z")

</div>

I am using Elastic with Kibana. What is the best way to get a Distinct count ?

I want effectively a "distinct count of IP by Account"

---

<div class="post-metadata">

**Author:** ![Marco\_Liberati](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marco_liberati/32/82953_2.png) [@Marco\_Liberati](https://discuss.elastic.co/u/Marco_Liberati)\
**Post date:** [June 3, 2024, 3:53pm UTC](https://discuss.elastic.co/t/kibana-distinct-count/360727/2 "2024-06-03T15:53:47Z")

</div>

Hi @dfir

you can create a new visualization (from a dashboard) and select the Table chart type, then configure a Top values of Account and Unique count of IP

---

<div class="post-metadata">

**Author:** ![dfir](https://avatars.discourse-cdn.com/v4/letter/d/76d3ee/32.png) [@dfir](https://discuss.elastic.co/u/dfir)\
**Post date:** [June 3, 2024, 3:54pm UTC](https://discuss.elastic.co/t/kibana-distinct-count/360727/3 "2024-06-03T15:54:38Z")

</div>

I tried that but I was getting errors because the data I have ingested in my index is over a size limit.

Is there no way to do this like splunk in search and create a table?

![image](https://us1.discourse-cdn.com/elastic/original/3X/7/0/70857ab2ed78f1da202165f1c506f6e95625c33c.png)

---

<div class="post-metadata">

**Author:** ![Marco\_Liberati](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marco_liberati/32/82953_2.png) [@Marco\_Liberati](https://discuss.elastic.co/u/Marco_Liberati)\
**Post date:** [June 3, 2024, 4:12pm UTC](https://discuss.elastic.co/t/kibana-distinct-count/360727/4 "2024-06-03T16:12:26Z")

</div>

Interesting, that sounds like a big amount of data.  
I mean you can try the ESQL version, but that would limit the results to the first 10000k rows:

- open Discover and from the top right pick `Language: ES|QL` (or `Try ES|QL`) depending on your stack version
- type something like `FROM your_index | STATS count_distinct( ip ) BY account`

---

<div class="post-metadata">

**Author:** ![dfir](https://avatars.discourse-cdn.com/v4/letter/d/76d3ee/32.png) [@dfir](https://discuss.elastic.co/u/dfir)\
**Post date:** [June 3, 2024, 4:25pm UTC](https://discuss.elastic.co/t/kibana-distinct-count/360727/5 "2024-06-03T16:25:19Z")

</div>

I do not see any option to pick a language.

the query did not work either. I am on Version 8.7.1 at the moment.

---

<div class="post-metadata">

**Author:** ![Marco\_Liberati](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marco_liberati/32/82953_2.png) [@Marco\_Liberati](https://discuss.elastic.co/u/Marco_Liberati)\
**Post date:** [June 4, 2024, 7:42am UTC](https://discuss.elastic.co/t/kibana-distinct-count/360727/6 "2024-06-04T07:42:48Z")

</div>

ES|QL has been introduced with stack version 8.11, but if you need to upgrade I'd recommend to go to 8.13.