How to get a distinct count across two different fields. I have webserver request logs containing browser family and IP address – so should be able to get a count of different & distinct user-browsers by browser family – i.e. how many different users are using Safari for example. But piping into:
stats dc(ua_family,cp_ip) by ua_family
… doesn’t do it - I get a distinct list of browser families but zero counts. But concatenating the fields:
eval comb=c_ip.ua_family | stats dc(comb) by ua_family
…does work. Is there a way to do it without concatenating? So why didn’t the dc on the two separate fields work?