# Kibana Lens - is there a way to just count a field and not all records?

**URL:** <https://discuss.elastic.co/t/kibana-lens-is-there-a-way-to-just-count-a-field-and-not-all-records/279694>\
**Category:** Kibana\
**Tags:** lens\
**Created:** [July 27, 2021, 7:26am UTC](https://discuss.elastic.co/t/kibana-lens-is-there-a-way-to-just-count-a-field-and-not-all-records/279694 "2021-07-27T07:26:38Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![lorenzPowerdale2](https://avatars.discourse-cdn.com/v4/letter/l/848f3c/32.png) [@lorenzPowerdale2](https://discuss.elastic.co/u/lorenzPowerdale2)\
**Post date:** [July 27, 2021, 7:26am UTC](https://discuss.elastic.co/t/kibana-lens-is-there-a-way-to-just-count-a-field-and-not-all-records/279694/1 "2021-07-27T07:26:38Z")

</div>

I am trying to do a quick Virtualisation. The idea is to take take all values that have Errors/"Reden" and group them by the CP Communication Unit.

So in theorie not very different from what we are seeing here:

[![Screenshot](https://us1.discourse-cdn.com/elastic/original/3X/3/6/3650c52a403e7490a8cd9e8d6f078dc14a02e896.jpeg)](https://i.stack.imgur.com/7tMvu.png)

The problem here is that it takes the CP Communication unit are chosen by the maximum value of an error, not the maximum value of **ALL** errors.

Basically instead of the Top value I would like to have the **CP Communication Unit** which had the **most errors** and **NOT** the **CP Communication Unit** which had a **specific error the most time**.

Thanks in advance, Lorenz

---

<div class="post-metadata">

**Author:** ![ghudgins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ghudgins/32/138532_2.png) [@ghudgins](https://discuss.elastic.co/u/ghudgins)\
**Post date:** [July 27, 2021, 12:48pm UTC](https://discuss.elastic.co/t/kibana-lens-is-there-a-way-to-just-count-a-field-and-not-all-records/279694/2 "2021-07-27T12:48:45Z")

</div>

I could be misunderstanding but what about trying a "Unique count" on your error field help to return a count of errors instead of seeing the same error repeated

---

<div class="post-metadata">

**Author:** ![lorenzPowerdale2](https://avatars.discourse-cdn.com/v4/letter/l/848f3c/32.png) [@lorenzPowerdale2](https://discuss.elastic.co/u/lorenzPowerdale2)\
**Post date:** [July 28, 2021, 9:06am UTC](https://discuss.elastic.co/t/kibana-lens-is-there-a-way-to-just-count-a-field-and-not-all-records/279694/3 "2021-07-28T09:06:46Z")

</div>

> [@ghudgins](#):
>
> I could be misunderstanding but what about trying a "Unique count" on your error field help to return a count of errors instead of seeing the same error repeated

basically I would like to have something like this:

 ![Bildschirmfoto 2021-07-28 um 11.05.33](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1a9477c25d6257f15f7ca4c41bcd2dbf7d139296.jpeg)

The devices with the most errors in total should be shown

---

<div class="post-metadata">

**Author:** ![ghudgins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ghudgins/32/138532_2.png) [@ghudgins](https://discuss.elastic.co/u/ghudgins)\
**Post date:** [July 28, 2021, 1:46pm UTC](https://discuss.elastic.co/t/kibana-lens-is-there-a-way-to-just-count-a-field-and-not-all-records/279694/4 "2021-07-28T13:46:31Z")

</div>

I was proposing you change your "Charges with flaws" definition to do a "Unique Count" of your error field instead of a count. This will only count each error once even if it's in many elasticsearch documents.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/5/452005c6ff2b159a6182ae643613ae1bd7aa1e9c.png)

I believe this will get you this result you asked for:

> the **CP Communication Unit** which had the **most errors**

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 25, 2021, 1:47pm UTC](https://discuss.elastic.co/t/kibana-lens-is-there-a-way-to-just-count-a-field-and-not-all-records/279694/5 "2021-08-25T13:47:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
