# Return Unique Field Values

**URL:** <https://community.graylog.org/t/return-unique-field-values/5299>\
**Category:** Graylog Central (peer support)\
**Created:** [May 21, 2018, 3:59pm UTC](https://community.graylog.org/t/return-unique-field-values/5299 "2018-05-21T15:59:29Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sapplega](https://avatars.discourse-cdn.com/v4/letter/s/85f322/32.png) [@sapplega](https://community.graylog.org/u/sapplega)\
**Post date:** [May 21, 2018, 3:59pm UTC](https://community.graylog.org/t/return-unique-field-values/5299/1 "2018-05-21T15:59:29Z")

</div>

Greetings! I would like to be able to run a search that would return a list of messages that have only unique values in the client\_ip field. Is this possible? I need to export the resulting list for processing in another application. When I report on all IP addresses, the result contains millions of records and is too large to process. I just need a list of unique IP addresses, which is only a few thousand

---

<div class="post-metadata">

**Author:** ![Fl4m3Ph03n1x](https://avatars.discourse-cdn.com/v4/letter/f/3da27b/32.png) [@Fl4m3Ph03n1x](https://community.graylog.org/u/Fl4m3Ph03n1x)\
**Post date:** [May 23, 2018, 8:22am UTC](https://community.graylog.org/t/return-unique-field-values/5299/2 "2018-05-23T08:22:59Z")

</div>

I am not sure this is possible wit the current querying language ( I think its not ):

[http://docs.graylog.org/en/2.4/pages/queries.html](http://docs.graylog.org/en/2.4/pages/queries.html)

But what I know is possible, is that you can:

1. Do your search
2. Export the Data as CSV
3. post process this data with a script and pick only unique IPs

As long as output order doesn’t matter, this should have you covered.

Another solution would be to create your own Plugin for Graylog2 that does that:

[http://docs.graylog.org/en/2.4/pages/plugins.html](http://docs.graylog.org/en/2.4/pages/plugins.html)

---

<div class="post-metadata">

**Author:** ![notnightman](https://avatars.discourse-cdn.com/v4/letter/n/b5a626/32.png) [@notnightman](https://community.graylog.org/u/notnightman)\
**Post date:** [May 31, 2018, 8:56pm UTC](https://community.graylog.org/t/return-unique-field-values/5299/3 "2018-05-31T20:56:02Z")

</div>

This has been requested a handful of times in the past. Its a shame that it isn’t possible without the steps noted above since other Elasticsearch backed logging systems are able to do this without the extra steps.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [June 14, 2018, 8:56pm UTC](https://community.graylog.org/t/return-unique-field-values/5299/4 "2018-06-14T20:56:02Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.