# Search data in discover tab, then apply unique count to results

**URL:** https://discuss.elastic.co/t/search-data-in-discover-tab-then-apply-unique-count-to-results/76466
**Category:** Kibana
**Created:** [February 25, 2017, 7:00am UTC](https://discuss.elastic.co/t/search-data-in-discover-tab-then-apply-unique-count-to-results/76466 "2017-02-25T07:00:42Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![darkPotato](https://avatars.discourse-cdn.com/v4/letter/d/e99b99/32.png) [@darkPotato](https://discuss.elastic.co/u/darkPotato)
#### Post date: [February 25, 2017, 7:00am UTC](https://discuss.elastic.co/t/search-data-in-discover-tab-then-apply-unique-count-to-results/76466/1 "2017-02-25T07:00:42Z")

</div>

I have a saved search in the discover tab that looks like this

 ![](https://us1.discourse-cdn.com/elastic/original/2X/b/b2d92a61de05f8b5c76a901b6c893bf99d72d509.png)

I am wanting to sort this data based on the unique count of the username field. In this case, because all of the ip's in the data are the same, I want only one record to show. If there were two ip's in that data, I would want only two records to show. Is there a way to build a table this way? I have tried the data table in the visualization tab, and it does allow me to apply a metric that sorts the unique count of the username, however, it does not actually list the data into a table. How would I achieve this?

---

<div class="post-metadata">

### Author: ![Stacey\_Gammon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stacey_gammon/32/14025_2.png) [@Stacey\_Gammon](https://discuss.elastic.co/u/Stacey_Gammon)
#### Post date: [February 27, 2017, 3:10pm UTC](https://discuss.elastic.co/t/search-data-in-discover-tab-then-apply-unique-count-to-results/76466/2 "2017-02-27T15:10:02Z")

</div>

You are on the right track with the data table visualization. You should be able to get the ip to show by splitting the rows under the `buckets` section. Is this the data you want to see in the table?

 ![](https://us1.discourse-cdn.com/elastic/original/2X/5/52e09a240e95ddf0ad9055b0427b7557495c634c.png)

You can further break down the rows but you may get more rows per ip address if there are unique values per ip address.

 ![](https://us1.discourse-cdn.com/elastic/original/2X/d/d4119601bc3a30c6facc146caa688c3abb3a2c38.png)

---

<div class="post-metadata">

### Author: ![darkPotato](https://avatars.discourse-cdn.com/v4/letter/d/e99b99/32.png) [@darkPotato](https://discuss.elastic.co/u/darkPotato)
#### Post date: [February 28, 2017, 2:22am UTC](https://discuss.elastic.co/t/search-data-in-discover-tab-then-apply-unique-count-to-results/76466/3 "2017-02-28T02:22:15Z")

</div>

Hi, thanks. I think I can work with this. I am trying to get the most recent record for each username in the entire set of data. But once I get that record, I want to show all of the fields for that record. I wonder if I can combine a query in the discover tab with an aggregation. I'm very new at elasticsearch

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 28, 2017, 2:22am UTC](https://discuss.elastic.co/t/search-data-in-discover-tab-then-apply-unique-count-to-results/76466/4 "2017-03-28T02:22:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.