Dumb question: Getting counts

[bpizzutiWHI]

Ok, I might be having a brain fart here. I'm pulling in some error logs, and I need to figure out how to show the number of unique entries over the past 24 hours...not total entries, and not the count of unique entries, I need to know the total count of unique error messages. And I just can't seem to wrap my way around a way to get NLS to show it. Anyone have any thought?

[dwhitfield]

I'm not sure I understand the question.

Here are some example logs:
11
12
13
11
11
11
11

Do you want this to report:
A) 3
B) 11 (5), 12 (1), 13, (1) [or more likely, one of those individually]
C) something else?

I think it's pretty clear you don't want it to output 7.

[mcapra]

Official Kibana documentation, albiet for a newer version, that says "yes you can do that":
https://www.elastic.co/guide/en/kibana/ ... chart.html

I think what you want to add to your dashboard is a "Terms" panel or a "Count" panel; I forget the exact naming of things. In a nutshell, you create a Terms/Count panel, target the specific field you want to look at "unique values" for, then each unique value will be listed with a total count up to whatever limit you set when defining the panel (10 by default I think).

So if you had a bunch of different error codes stored in the ErrorCode field, you could create a panel on your dashboard that lists each unique ErrorCode as well as the number of occurrences. I believe this is what you're looking for?

Hopefully someone staring at an NLS GUI can take things from there

[kyang]

Thanks @mcapra!

OP, Can you confirm this is what you wanted?

[bpizzutiWHI]

Sorry to ressurect the zombie thread, I just realized I never got back to this one. In answer to dwhitfield's question, I was looking for the output of 3, yes.

[cdienger]

Have you tried adding a panel as @mcapra suggested? I tested on a system and to return a count of the top 4 error codes, it would look like: