# Kibana, unique or distinct count alerting
**URL:** https://discuss.elastic.co/t/kibana-unique-or-distinct-count-alerting/263803
**Category:** Kibana
**Tags:** elastic-stack-alerting
**Created:** [February 9, 2021, 8:10pm UTC](https://discuss.elastic.co/t/kibana-unique-or-distinct-count-alerting/263803 "2021-02-09T20:10:25Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@earlsanchez](https://discuss.elastic.co/u/earlsanchez)
#### Post date: [February 9, 2021, 8:10pm UTC](https://discuss.elastic.co/t/kibana-unique-or-distinct-count-alerting/263803/1 "2021-02-09T20:10:26Z")
Hello,
Using Kibana Discovery and then Alerting is it possible to create an alert based on the count of a unique field value during a particular time period? For instance, in Splunk I can alarm a query such as this:
```auto
index=ct-inf host="cms-prod-app" sourcetype="ix-ixiasoft-ccms" "Unable to authenticate user" | stats count by username | where count >= 4
```
So if a particular username gets 4 authentication failures in a particular time period Splunk will send an alert.
Is this possible in Kibana?
I also set this up in a Data Table visualization and then tried to cut/paste the json request into a Kibana Monitor, but it did not get any hits as expected.
TIA!
---
### Author:  [@nickpeihl](https://discuss.elastic.co/u/nickpeihl)
#### Post date: [February 11, 2021, 8:57pm UTC](https://discuss.elastic.co/t/kibana-unique-or-distinct-count-alerting/263803/2 "2021-02-11T20:57:52Z")
Hi @earlsanchez. It sounds like you might be looking for [Log Threshold Alerts](https://www.elastic.co/guide/en/observability/7.11/logs-threshold-alert.html). You can count log entries by grouping over a field such as `username` and setting conditions for failed authentication and time windows.
---
### Author:  [@earlsanchez](https://discuss.elastic.co/u/earlsanchez)
#### Post date: [February 12, 2021, 9:22pm UTC](https://discuss.elastic.co/t/kibana-unique-or-distinct-count-alerting/263803/3 "2021-02-12T21:22:15Z")
@nickpeihl, thank you for your input. Unfortunately, we are using open source ELK stack which does not appear to have that functionality?
---
### Author:  [@nickpeihl](https://discuss.elastic.co/u/nickpeihl)
#### Post date: [February 18, 2021, 11:45pm UTC](https://discuss.elastic.co/t/kibana-unique-or-distinct-count-alerting/263803/4 "2021-02-18T23:45:33Z")
Hi @earlsanchez. Correct, Alerting is not available in the open source product.
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [February 19, 2021, 1:51am UTC](https://discuss.elastic.co/t/kibana-unique-or-distinct-count-alerting/263803/5 "2021-02-19T01:51:39Z")
@earlsanchez There has been some confusion lately ... You can use the Basic / Default distribution under the [Elastic License 2.0](https://github.com/elastic/kibana/blob/7.11/licenses/ELASTIC-LICENSE-2.0.txt) (which is Free to use) that distribution does have the basic alerting feature that you are looking for. It is the default distribution you get when you download from our download site e.g. [here](https://www.elastic.co/downloads/kibana)
This default distribution is governed by the Elastic License, and includes the [full set of free features](https://www.elastic.co/subscriptions).
Oh and BTW that looks like a security use case where you might be able to use the Security App and Detections which are also free to use.
You might want to look at what is available for free [here](https://www.elastic.co/subscriptions)
---
### Author:  [@earlsanchez](https://discuss.elastic.co/u/earlsanchez)
#### Post date: [February 20, 2021, 2:04am UTC](https://discuss.elastic.co/t/kibana-unique-or-distinct-count-alerting/263803/6 "2021-02-20T02:04:39Z")
Thank you @stephenb, yes we are already using the Alerting module.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 20, 2021, 2:04am UTC](https://discuss.elastic.co/t/kibana-unique-or-distinct-count-alerting/263803/7 "2021-03-20T02:04:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.