The distinct operator identifies unique values within each of the specified fields. It’s used to retrieve distinct values for each field independently. distinct finds unique values within each provided field separately, helping you to analyze and explore data uniqueness within individual fields.

Syntax ​

Scope | distinct [ maxCombinations ] [ maxDepth ] FieldName [= Expression] [, ...]

Arguments ​

• Scope: The events to search.
• maxCombinations: The maximum number of distinct combinations. Defaults to 10000. Cannot exceed the Results limit configured in the Usage Group, which defaults to 50000.
• maxDepth: The maximum depth for searching unique combinations of field values. This controls how deep the search goes when identifying distinct combinations within nested or hierarchical data structures. Defaults to 15.
• FieldName: One or more fields you want to find distinct values for. This operator allows you to identify unique values within the specified field(s) from your Dataset. A wildcard * indicates all available fields. You can also assign an expression inline using FieldName = Expression to compute a derived value and deduplicate on the result.

Examples ​

Find the distinct values for all fields in your Dataset.

  dataset=myDataset
  | distinct *

Find unique values within the host and port fields.

  dataset=myDataset
  | distinct host, port

Find distinct values for the source field, limiting the search to 100 combinations and a depth of 10.

  dataset=myDataset
  | distinct maxCombinations=100 maxDepth=10 source

Compute a derived value inline and deduplicate on the result.

  dataset=myDataset level=error
  | distinct x = strcat('ERROR: ', message)

dataset=$vt_dummy event<1000
| distinct randomNumber=rand(10)