# Filter on unique field **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [December 27, 2019, 7:13pm UTC](https://community.graylog.org/t/filter-on-unique-field/13316 "2019-12-27T19:13:11Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Audian16](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/audian16/32/5549_2.png) [@Audian16](https://community.graylog.org/u/Audian16)\ **Post date:** [December 27, 2019, 7:13pm UTC](https://community.graylog.org/t/filter-on-unique-field/13316/1 "2019-12-27T19:13:11Z")
Is there a way to view a unique count for a single field over time? Example might be a GUID field. Some GUIDs appear daily, others appear once every 6 weeks. I’d like a view/report to show UNIQUE GUIDs over a period of time. ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [December 29, 2019, 10:40am UTC](https://community.graylog.org/t/filter-on-unique-field/13316/2 "2019-12-29T10:40:08Z")
Do you have that data over the complete period you want to view? What Graylog version are you using? Is that data you want the overview in a unique field or part of another field? ---
**Author:** ![Audian16](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/audian16/32/5549_2.png) [@Audian16](https://community.graylog.org/u/Audian16)\ **Post date:** [December 30, 2019, 3:54am UTC](https://community.graylog.org/t/filter-on-unique-field/13316/3 "2019-12-30T03:54:59Z")
The data is present in a unique field over the complete period I want to view. I’m using Graylog 2.4.6+ceaa7e4 ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [December 30, 2019, 12:06pm UTC](https://community.graylog.org/t/filter-on-unique-field/13316/4 "2019-12-30T12:06:10Z")
if you do a search to identify the information you like to see - use the so called quick values to get this. [https://docs.graylog.org/en/2.4/pages/dashboards.html?quick-values-results#quick-values-results](https://docs.graylog.org/en/2.4/pages/dashboards.html?quick-values-results#quick-values-results) ---
**Author:** ![Audian16](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/audian16/32/5549_2.png) [@Audian16](https://community.graylog.org/u/Audian16)\ **Post date:** [December 30, 2019, 2:14pm UTC](https://community.graylog.org/t/filter-on-unique-field/13316/5 "2019-12-30T14:14:53Z")
Thanks! My profile doesn’t have dashboards, so I’m getting admin to enable, then I will try that. Will that represent unique counts of that particular field? Would this work for fields that only contain IP address? ---
**Author:** ![Audian16](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/audian16/32/5549_2.png) [@Audian16](https://community.graylog.org/u/Audian16)\ **Post date:** [December 30, 2019, 5:31pm UTC](https://community.graylog.org/t/filter-on-unique-field/13316/6 "2019-12-30T17:31:50Z")
Okay, I tried that and it doesn’t appear to be producing the data I am looking for. I’m looking for a way to easily see unique counts in the Graylog dashboard. Similar to what I would get if I export data for a 4-week window and use Excel to remove duplicates from field=IP\_Address. ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [December 30, 2019, 6:05pm UTC](https://community.graylog.org/t/filter-on-unique-field/13316/7 "2019-12-30T18:05:48Z")
he @Audian16 you do not look for something like: ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/c/c5766025687cc1d4d18e6a5a4464ed4b4febb750.png) you just wand to have the names without any count and other stats? ---
**Author:** ![Audian16](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/audian16/32/5549_2.png) [@Audian16](https://community.graylog.org/u/Audian16)\ **Post date:** [December 30, 2019, 7:13pm UTC](https://community.graylog.org/t/filter-on-unique-field/13316/8 "2019-12-30T19:13:51Z")
I don’t think that is the view I need. Let’s say I have 800,000 entries across a period of 3 days. I can confirm that their are 150,000 servers that are generating those 800,000 entries but exporting the data and manually cleaning the entries (removing duplicates). How can I search for unique number of reporting servers in the Graylog interface to show a count of 150,000 instead of 800,000? ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [January 6, 2020, 9:37am UTC](https://community.graylog.org/t/filter-on-unique-field/13316/9 "2020-01-06T09:37:05Z")
The quick values is for this - you just do this on the source and get a list of all sources that report in. You might want to use the views as you can be more specific in that list and you can get a data table with that result. Should you want to have that unique list exported - that is currently not possible and you would need to createa feature request over at github. ---
**Author:** ![Audian16](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/audian16/32/5549_2.png) [@Audian16](https://community.graylog.org/u/Audian16)\ **Post date:** [January 6, 2020, 4:56pm UTC](https://community.graylog.org/t/filter-on-unique-field/13316/10 "2020-01-06T16:56:51Z")
Okay, thanks for explaining that. I appreciate the help! ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [January 20, 2020, 4:57pm UTC](https://community.graylog.org/t/filter-on-unique-field/13316/11 "2020-01-20T16:57:02Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.