Kibana Lens - is there a way to just count a field and not all records?

[lorenzPowerdale2]

I am trying to do a quick Virtualisation. The idea is to take take all values that have Errors/"Reden" and group them by the CP Communication Unit.

So in theorie not very different from what we are seeing here:

The problem here is that it takes the CP Communication unit are chosen by the maximum value of an error, not the maximum value of ALL errors.

Basically instead of the Top value I would like to have the CP Communication Unit which had the most errors and NOT the CP Communication Unit which had a specific error the most time .

Thanks in advance, Lorenz

[ghudgins (Graham Hudgins)]

I could be misunderstanding but what about trying a "Unique count" on your error field help to return a count of errors instead of seeing the same error repeated

[lorenzPowerdale2]

@ghudgins

I could be misunderstanding but what about trying a "Unique count" on your error field help to return a count of errors instead of seeing the same error repeated

basically I would like to have something like this:

The devices with the most errors in total should be shown

[ghudgins (Graham Hudgins)]

I was proposing you change your "Charges with flaws" definition to do a "Unique Count" of your error field instead of a count. This will only count each error once even if it's in many elasticsearch documents.

I believe this will get you this result you asked for:

the CP Communication Unit which had the most errors