Splunk count distinct values. This is similar to SQL aggregation.

Splunk count distinct values May 31, 2017 · The problem I am running into is that my csv file has multiple of the same X values in it so instead of field Y ending up with the same counts as field X, it is becoming (X * # of matched duplicates in csv). In this example, mvcount() returns the number of email addresses in the To, From, and Cc fields and saves the addresses in the specified "_count" fields. This function processes field values as strings. If I use stats values; it returns all the values into a single line. How field values are processed Most of the statistical and charting functions expect the field values to be numbers. ind Jun 25, 2019 · I want to add V3 column along where V3 will show THE count OF DISTINCT VALUES OF V2. more than one unique value) of 'sid' in one result. Aug 7, 2019 · So I'm trying to get a distinct count of source mac addresses by device. If a BY clause is used, one row is returned for each distinct value in the field specified in Jul 27, 2023 · List unique values from splunk events Asked 2 years, 3 months ago Modified 2 years, 3 months ago Viewed 2k times Jan 18, 2012 · I already have the transforms. The first value of accountname is everything before the "@" symbol, and the second value is everything after. In the "Codes" field i'll get multiple values and will count the values totally by using "dc(Codes) as Count". This is my Nov 23, 2016 · If I use distinct count then only 1 even is returned and if i use distinct count with a filter by quoteNumber then all works and the duplicates are removed however the results are returned as separate events in table format. g. Jul 18, 2025 · This topic discusses how to use the statistical functions with the transforming commands chart, timechart, stats, eventstats, and streamstats. Given a set of events Jul 16, 2025 · If no limit specified, the top ten results by count are returned. These fields contain a similar value. Sep 16, 2022 · How do i get a total count of distinct values of a field ? For example, as shown below Splunk shows my "aws_account_id" field has 100+ unique values. I am using | stats count by Field-A to give me the number of occurrences of A1, A2, A3 and am trying to include a single example of Field-B. Is this feasible? V2 too could have distinct x y zs. Oct 1, 2018 · Solved: I can search for events and run stats count by host. Feb 19, 2025 · The fieldsummary command analyzes your search results and provides detailed statistics about each field. This is similar to SQL aggregation. In SQL, I'd use "SELECT DISTINCT TEXT FROM MYTAGS", but I don't know about the Splunk query values. Mar 3, 2022 · The values aggregate function produces a list (JSON array) of distinct values of the target field, even if the list contains a single entry. Please find below the example of my result table: Username---------------------- This search uses the count() function to return the total count of the purchases for the VIP shopper. Codes Count 123 10 111 222 333 444 555 The above is showing us as total count of val Oct 14, 2022 · I need to count distinct values not including null values Field ABC CBA BCA null null null I need | eventstats dc (field) as "field_count" to return 3, but it returns 4. The function descriptions Nov 29, 2023 · In this blog post we'll cover the basics Queries, Commands, RegEx, SPL, and more for using Splunk Cloud and Splunk Enterprise This example returns summaries for fields in the _internal index with names that contain "size" and "count". Boost your Splunk skills and get ahead of the competition. "ns=myApplication" "trying to insert document with keyId:"| rex field=message "(?<id>(AA_\\d+)|(BB_\\d+))" | table id Some of thos Oct 31, 2023 · I would like to only get statuses for the distinct correlationId's, meaning that with the sample dataset I would only get back a count for 4 correlationId's and the statuses that are the latest date. Apr 23, 2012 · How can I retrieve count or distinct count of some field values using stats function phaniraj Explorer Learn how to count unique values in Splunk with this step-by-step guide. May 13, 2019 · I am beginner to Splunk and could you help me with the following scenario. Most aggregate functions are used with numeric fields. The function descriptions Jul 27, 2015 · However, it is not a normal behavior of the system for 'sid' to have two different values in one result. txt", job_status=outgoing, jo Aug 11, 2025 · If I understood you correctly, you want to group by src_ip, list all the distinct user values per IP, and also count how many times each user appears Splunk Count Occurrences of Field Value: A Powerful Tool for Data Analysis Splunk is a powerful tool for analyzing data. Below is what I tried, obfuscated : stats dc(var1) as some_name by var2 which returns a column of values , say {1, 55, 2200, 45, 100, . Examples Using the pivot function Consider the following data that's in the main Apr 7, 2025 · I want to add a trendline to this chart: index=my_index | timechart dc (USER) as DISTINCT_USERS How do I accomplish this? Thanks! Jonathan Hi, I want to get all the unique values of a field into a line separated file. e. I. Please provide the example other than stats May 13, 2019 · The query you have right now simply returns the number of unique IP addresses. I would have to run a regex command to replace spaces into new lines in a text editor. 50) I'm scratching my head trying to create a search to get a count of events with common value for the subject field as a start. Using this search, I get the name of the first host in the single value module. Users B and F both came to page one with account 567, but only F proceeded. The <value> argument must be an aggregate, such as count() or sum(). All of the values are processed as numbers, and any non-numeric values are ignored. Jan 31, 2019 · I need to count the total based on status, but also the number of sessions for each status. You can use this function with the stats, eventstats, streamstats, and timechart commands. The values function is used to display the distinct product IDs as a multivalue field. When you use the span argument, the field you use in the <by-clause> must be either the _time field, or another field with values in UNIX time. list field) to be able to get data in format where n is a number of unique email addresses for each type? Aug 7, 2013 · You can estimate how many distinct items you have tried to hash based on the number of hash collisions and the size of the hash bucket. Basic examples The following example removes duplicate results with the same host value and returns the Sep 4, 2014 · the below search will give me distinct count of one field by another field some search | stats dc (field1) by field2 but how would I get the distinct values for field1 by field2 so i want something like below: some search | stats distinct (field1) by field2 Jun 20, 2020 · I want a distinct count for a given field by day, but this count also needs to look at all previous days in the given time range to see the remaining distinct count? For example: When I search for all events that are on Monday the result is : a,b,c,d,c,z When I search for all events that are on T Feb 19, 2013 · You need in a field the value you're trying to plot and if I understand well, you don't have this value anywhere in your log files. Is this perhaps a hard coded limit somewhere? Apr 14, 2020 · Hi, I am new to Splunk. The values in the array are sorted in alphabetical order for text fields and in ascending order for numeric fields. This can be a valuable tool for identifying trends, patterns, and anomalies in your data. Regex is correct, I validated that. I am trying to isolate 1 field and get a count of the value of that field and display the count in an existing table as a new field This is m Mar 12, 2013 · What I'm looking for is a hybrid of the stats list() and values() functions. For the list of stats functions, see "Statistical and charting functions" in the Search Reference. Then the stats command will build a single list of unique values of your ip addresses. Each sessionID could have multiples of each unique field value. When I search for April the result is : a,b,c,d,c When I search for May the Jul 3, 2025 · The dc (or distinct_count) function returns a count of the unique values of userid and renames the resulting field dcusers. The search returns only the top 10 values for each field from the last 15 minutes. This is a powerful tool for identifying trends and patterns in your data. I added a |where DISTINCT_IP > 1 to get exactly what i needed. ?$| [^W]. So I have a xml where a particular node can appear one time or multiple times and there are many nodes like this. Jan 14, 2016 · I have lots of logs for client order id ( field_ name is clitag ), i have to find unique count of client order( field_ name is clitag ) received so far that day? This function returns the count of distinct values in a field. The eventstats is then summing all those count values and adding it as a new field to each row. I can use stats dc() to get to the number of unique instances of something i. If you don't rename the function, for example "dc (userid) as dcusers", the resulting calculation is automatically saved to the function call, such as "dc (userid)". Lets take I have a table with the field name "Computer". I am using chart to summarize by hour and eventstats to track maximums over a given day. First, I'd like the list of unique values for a multivalue field, then alongside each unique value, I'd like the count of occurrences of that value. but not the total count. See ADQL Expressions. How can wri How to get distinct values and their counts from fields arrays karol New Member yesterday May 22, 2025 · Learn how Splunk's mvzip and mvcount commands simplify multi-value field analysis. The technique is accurate to about 1-2%, although it may be over or undercounting. If we add the host field to our BY clause, the results are broken out into more distinct groups. The number of sessions is the distinct count of the sessionId field. Apr 23, 2017 · I would like to summarize the count of distinct iMAC addresses seen per hour, chart and also insert a column of the maximum value of the distinct count over a period of time in order to analyze a lease pool. I want to add V3 column along where V3 will show THE count OF DISTINCT VALUES OF V2. Is this possible? Maybe this is better illustrated through an example. count a user when they first purchased flowers, and never count them again. Use this function to count the number of different, or unique, products that the shopper bought. Jul 27, 2014 · Hello all, I am trying to search for distinct count higher than a value. Jul 31, 2013 · absolutely perfect!! looks my main problem i was doing the dc (ip) as a separate stats statement when trying to get the count. Aug 17, 2017 · Just so i'm understanding, let me repeat what I'm understanding. Mar 25, 2024 · EventCode=4624 user=* | timechart span1d count as count_user by user | stats count by user So the login event 4624 would be a successful log in code and then trying to get it to give me a stat number of the unique values of user names that get it each day for a time span. Giv Calculates aggregate statistics, such as average, count, and sum, over the results set. csv May 6, 2021 · It's a very inefficient operation in Splunk. The stats command can be used for Jul 4, 2025 · How field values are processed Most of the statistical and charting functions expect the field values to be numbers. If you want the actual list of unique addresses, try this: splunk_server=* index="mysiteindes" host=NXR4RIET313 SCRAPY | stats values(src_ip) Or: splunk_server=* index="mysiteindes" host=NXR4RIET313 SCRAPY | stats count by src_ip To also get the number of events for each unique address. Query which you have given above fetching 0 results even though I have multiple person_id present in logs. Basically on page1 I can dedup the AccoutNum, UserID (I don't care if the same user comes through with the same account), but I do care if a different user does. The results are then piped into the stats command. Hopefully, I'll be able to articulate what Jul 17, 2017 · splunk - Get a distinct count of field values matching a regex Asked 7 years, 9 months ago Modified 6 years, 4 months ago Viewed 2k times Calculates aggregate statistics, such as average, count, and sum, over the results set. The field Name "Computer" when searched for different time period gives me different values. I want distinct counts after combining both pieces of field data. I want to combine both in one table. +|W [^F]. When I run the search below it gives a count of all events, it looks like where there's both a srcmac and a devtype. On the other hand I can use dedup and then table. You can use the output for initial data analysis, troubleshooting data quality issues, or planning transformations. Is this what is happening, or does it count the user once in the first month, and then count them once again in the second month (assuming time slices are in months)? Jul 18, 2025 · Calculates aggregate statistics, such as average, count, and sum, over the results set. Now I want to add a column that adds up the Unique workstations so the ap Apr 20, 2020 · Solved: I would like to get a count of errors that I have generated on splunk from different objects. Mar 27, 2018 · Solved: I have used below query to get distinct values: stats values (gitRepo) AS serviceName BY buildNum This gives correct values. Jan 9, 2017 · So the data available before eventstats was the output of "stats count by myfield", which will give you one row per myfield with corresponding count. You want a distinct count of terminals, by user INSTEAD of the values of the Jul 4, 2025 · If you are using the distinct_count function without a split-by field or with a low-cardinality split-by by field, consider replacing the distinct_count function with the estdc function (estimated distinct count). Mar 15, 2018 · I want to get unique values in the result. I'm trying to 'join' two queries using the 'stats values' for efficiency Jul 6, 2020 · Which stats command function provides a count of how many unique values exist for a given field in the result set? Mar 9, 2021 · Hi, I have a weird requirement where I have to count the distinct values of a multi value field. Using Fields in Search The field names can also be inserted into the search box along with the specific values for the search. Jan 30, 2018 · I have a table like below: Servername Category Status Server_1 C_1 Completed Server_2 C_2 Completed Server_3 C_2 Completed Server_4 C_3 Completed Server_5 C_3 Pending Server_6 C_3 Feb 28, 2020 · I don't know if I need to work with join or distinct count. So I'm trying to find all results for a certain time frame where there are multiple values (i. Includes examples and best practices. The function descriptions May 9, 2016 · I'm new to Splunk and am not quite sure how to approach this. Feb 20, 2021 · Group by count distinct, time buckets How many unique values for my_field for each 1-minute bucket? Jul 3, 2025 · Calculates aggregate statistics, such as average, count, and sum, over the results set. Looking at the example you sent me (and perhaps I'm not stating with enough clarity so apologizes there) for example for acurry@buttercup games. Mar 19, 2021 · Hi there,I'm trying to query all computers that match 2 or more DISTINCT DisplayName fields. Count the number of values in a field Use the mvcount() function to count the number of values in a single value or multivalue field. Populating a daily summary index search with the results of something like Apr 6, 2017 · I am convinced that this is hidden in the millions of answers somewhere, but I can't find it. Aggregate functions summarize the values from each event to create a single, meaningful value. etc} How do I extract from that column values higher than a "limit" ? I tried stats dc(var Sep 20, 2011 · I'm using index=main earliest=-1d@d latest=@d | stats distinct_count(host) by host | addcoltotals fieldname=sum | rangemap field=sum in an attempt to get a count of hosts in to a single value module on a dashboard. index="mail" | stats dc (subject) as subjectcount | where subjectcount > 50 Nov 26, 2019 · I'm scratching my head trying to create a search to get a count of events with common value for the subject field as a start. All of them have a field error. You can use this function with the SELECT clause in the from command, or with the stats command. But, I only want the distinct values of that field. But I want the count of occurrences of each of the unique instances i. Mar 13, 2013 · ‎ 03-12-2013 04:49 PM What I'm looking for is a hybrid of the stats list () and values () functions. They are in the form of - person_id="9e9f0ec6-899e-43a8-b1e3-ca158516b6fe". Get started today and boost your Splunk skills! Use: Calculates aggregate statistics,such as average, count, and sum, over the results set. It shows all the distinct values for the field, their count and their percentages. What is that exact 100+ number ? If i hover my mouse on the field, it shows Top 10 values etc. In the below example, we aim to find all the records for the date, 15th Oct for the host named mailsecure_log. Oct 30, 2012 · Which I would expect to generate a timechart with the count of distinct/unique clientip over time. Common aggregate functions include Average, Count, Minimum, Maximum, Standard Deviation, Sum, and Variance. It's not distinct count of the product. More or less it will use constant time and resources regardless of the number of unique values. An example of my query so far would be: host=node-1 AND &quot;userCache:&quot; Which returns someth Aggregate functions summarize the values from each event to create a single, meaningful value. *)", it is to find person_ids which are not starting with 'WF'. Apr 5, 2015 · The broader question here "what's the best way to count distinct count of X for each value of foo and bar", has the simple answer | stats dc(X) by foo bar But the question here is more about how to do this with summary indexing, which is complicated for distinct counts. For more information about the stat command and syntax, see the "stats" command in the Search Reference. Which of the two is less taxing on the system? Jul 12, 2019 · Solved: Hi, I'm using this search: | tstats count by host where index="wineventlog" to attempt to show a unique list of hosts in the How field values are processed Most of the statistical and charting functions expect the field values to be numbers. For example, we receive events from three different hosts: www1, www2, and www3. I'm looking to make a bar chart where each bar has a value equal to the average # of unique users per day in a month divided by the total # of active users of that month, for every month in the year (Lets call this value Stickiness). Aug 5, 2024 · Hi all. The stats command can be used for Jun 25, 2019 · My results look like these: V1 V2 A X Y Z Z X Y Y B X X X Y Z Z X Y Y V2 IS A LIST. com, how do you get the unique/distinct count for each values (usage) so it would Aug 4, 2016 · Hi, I have a field called "UserID" and a DateActive field. NULL values? Splunk IT Service Intelligence null itsi kpi distinct published Nov 8, '19 by RickvdIJ 20 1 Vote 3 Answers 2. Apr 6, 2016 · Hello all, I'm looking to do a "count distinct value if record type = foobar" type of scenario. In my table of results there might be different IP's for the same username which are listed down in the single IP cell. Jul 4, 2025 · How field values are processed Most of the statistical and charting functions expect the field values to be numbers. The final result would be something like below - UserId, Total Unique Hosts, Total Non-US Unique Hosts user1, 42, 54 user2, 23, 95 So far I have below query wh How to get distinct values and their counts from fields arrays Dec 10, 2018 · Basically the field values (200, 400, 403, 404) become row labels in the results table. I managed to extract all the field values in the event, but I don't Apr 30, 2015 · I want a table that looks like this: Where the reason rows are error messages, and the column is another value "location" and I want to get the count of. Includes examples and screenshots. . the number of orders associated Aug 25, 2021 · Timechart with distinct_count per day Asked 4 years, 2 months ago Modified 4 years, 2 months ago Viewed 5k times Splunk List Unique Values Learn how to list unique values in Splunk using the `distinct` command. 50) I'm scratching my head trying to create a search to get a count of events with common value for the subject field a Calculates aggregate statistics, such as average, count, and sum, over the results set. The field_expression can take several forms. May 25, 2010 · That should make a multivalued field called ip and populates it with any IP-like values found in the event's raw text. The srcmac gives me the mac address The devtype gives me the type of device like Windows, Mac, Android etc. The stats command can be used for The SPL2 stats command calculates aggregate statistics, such as average, count, and sum, over the incoming search results set. Jul 4, 2025 · This example returns summaries for fields in the _internal index with names that contain "size" and "count". Any advice what could be going wrong. Since you did not supply a field name, it counted all fields and grouped them by the status field values. For exa Jul 4, 2025 · How field values are processed Most of the statistical and charting functions expect the field values to be numbers. I have a field called TaskAction that has some 400 values. See LIMIT Clause. Jul 26, 2016 · If your requirement is to get number of events for each product per week, including all 7 days of the week, you already have the query. With Splunk, you can easily find the unique values in any field, and use this information to make informed decisions about your business. So you should run a summary search every day or every hour which is counting the number of unique user ids since the previous time the summary search was run. Things i have tried as per other posts in the forum" Learn how to get distinct values in Splunk with this step-by-step guide. Discover practical use cases, syntax tips, and more. (AA_12345 for example). If a BY clause is used, one row is returned for each distinct value specified in the BY clause. 5k Views Jul 30, 2019 · How to count the number of different values (multivalue) in a field? Aug 5, 2021 · I'm trying to do a search in Splunk in which I'm trying to narrow it down to a unique substring. Nov 4, 2024 · Where Field-A will repeat but Field-B is unique values. If the stats command is used without a BY clause, only one row is returned, which is the aggregation over the entire incoming result set. Get started today and boost your Splunk skills! The string values 1. And I can run a search of distinct number of hosts. I have below log which is capturing product id, Header product-id, 12345678900 Header product-id, 12345678901 Header product-id, 12345678900 I would like to group by unique product id and count, 12345678900 2 12345678901 1 Here product-id is not a field in splunk. The function descriptions Mar 27, 2018 · Hi I have a query which runs and results me the list of Ip's in a table format grouped by username. I can get the distinct count:SecurityAlert| where ProductName The <key> argument can be a single field or a string template, which can reference multiple fields. unique customers. Usage To use this function, you can specify distinct_count(), or the abbreviation dc(). The function descriptions The <key> argument can be a single field or a string template, which can reference multiple fields. Nov 1, 2023 · Hello, How to calculate distinct count with condition? How to calculate unique vuln that has score >0, group by ip? Before calculation Nov 26, 2019 · I have events coming in from an email spam appliance and would like to have an alert on spam campaigns with a unique sender,subject or content if they exceed a certain number (e. Then we treat this as a rough weighting, and we just add up the values for each IP. Jul 23, 2025 · This example counts the values in the action field and organized the results into 30 minute time spans. May 25, 2012 · The distinctIPs value is the number of IP values that that row's ACCOUNT field was accessed by. Usage You can use the values(X) function with the chart, stats, timechart, and tstats commands. The stats command can be used for Aggregate functions summarize the values from each event to create a single, meaningful value. Th Jan 29, 2025 · I'm trying to count the unique values of a field by the common ID (session ID) but only once (one event). Nov 26, 2019 · I have events coming in from an email spam appliance and would like to have an alert on spam campaigns with a unique sender,subject or content if they exceed a certain number (e. The function descriptions values (<values>) Description The values function returns a list of the distinct values in a field as a multivalue entry. This command provides excellent insight through providing a wide range How field values are processed Most of the statistical and charting functions expect the field values to be numbers. Something like: Oct 20, 2015 · I have a json splunk logs, and I need to get the count of the number of times the "message" field is equal to "Total request time", and then in the same string I will need to get a count of the num Apr 15, 2015 · Solved: Hi I want to extract field values that are distinct in one event. | stats count BY Nov 16, 2017 · I am searching the my logs for key IDs that can either be from group 'AA' or group 'BB'. May 28, 2025 · Discover the top transforming and filtering commands in Splunk to refine your data searches, create insightful reports, and boost your threat detection capabilities. Dec 30, 2019 · It says how many unique values of the given field (s) exist. DB_INSTANCE_NAME= ansrp, flexp, sunopt, vlprod, buybprod, FDPOSPRD, aasprod, dcpscp, hydra, cidprod, gcdprd, p Aggregate functions summarize the values from each event to create a single, meaningful value. By default there is no limit to the number of values returned. The stats count() function is used to count the results of the eval expression. The order of the values is lexicographical. Examples Using the pivot function Consider the following data that's in the main Aggregate functions summarize the values from each event to create a single, meaningful value. The stats command can be used for Feb 15, 2020 · Learn to use Splunk stats commands to count, group, and visualize data with examples of conditional counting, replacing values, and more. However, there are some functions that you can use with either alphabetic string fields or numeric fields. The following functions process the field values as literal string values, even though the values are numbers. Dec 9, 2010 · I was working with a search similar to: my_nifty_search_terms | stats distinct_count(field) by date_hour and noticed that at least one of my counts stopped conveniently at 100,000. Plz help me with the query. values (<values>) Description The values function returns a list of the distinct values in a field as a multivalue entry. I find them by using rex and then display them in a table. Nov 12, 2018 · I have two different fields (DB_INSTANCE_NAME & INSTANCE_NAME ) in two source types. The mvindex() function is used to set from_domain to the second value in the multivalue field accountname. DISTINCT can not be applied to a wild card SELECT query, such as SELECT DISTINCT * String values must be surrounded by either single quotes or double quotes, such as 'hello' and "hello". Mar 10, 2016 · I have some fields "Codes" "Count". Nov 11, 2014 · Actually doing just | stats dc (HostName) as "HostCount", dc (Access) as "AccessCount" by User gives me a nice summary table for the user's host count and access count. Jul 13, 2017 · Solved: Hi, I wonder if someone could help me please. 0 and 1 are considered distinct values and counted separately. I have several different automated jobs such as generating checksums, tar and ffmpeg transcodes and they all write job information to log files like this: job="filename. This includes the number of events containing the field, distinct values, and frequency distributions. reason1, countofA, countofB, countofC, etc. Problem is I am Learn how to get unique values in Splunk with this step-by-step guide. The stats command can be used for Mar 16, 2018 · Hi I am working on query to retrieve count of unique host IPs by user and country. But i need the unique count of each code. For Ex. txt", job_status=incoming job="filename. For example, you could use Splunk to count the number of times a particular product was sold, or the This example returns summaries for fields in the _internal index with names that contain "size" and "count". How to get distinct values and their counts from fields arrays This example returns summaries for fields in the _internal index with names that contain "size" and "count". Oct 12, 2022 · I am working with event logs which contain many fields. One of its many features is the ability to count the occurrences of a field value. Is there any way for me to only get distinct rows from a lookup csv based on the matching field value (X in this case). I am after distinct count of all quotes / a distinct count of all quotes that have a processStatus of Referred. The dc() function is the distinct_count function. Jul 4, 2025 · Calculates aggregate statistics, such as average, count, and sum, over the results set. Nov 6, 2018 · Solved: Hi, How do I search through a field like field_a for its unique values and then return the counts of each value in a new table? example. Aug 17, 2017 · Greetings, I'm creating a stats table which shows Logon attempts to different workstations. Jul 17, 2017 · @sbbadri - Regex which I am using "Regex person_id="^ (. Jan 3, 2025 · Solved: distinct results in splunk and how to show all data in selected fields vs the 100+ results ITSI distinct count KPI: 0 vs. conf pulling out the values for the "tags", but not a way to say "Here are all of the values for that field". I have a column that shows the distinct workstations involved (even though they may logon to a machine more than once during the day). The country has to be grouped into Total vs Total Non-US. Nov 26, 2019 · I'm scratching my head trying to create a search to get a count of events with common value for the subject field as a start. Apr 22, 2020 · How I can "join" all emails (or maybe value of message. For the stats command, fields that you specify in the BY clause group the results based on those fields. conf and props. Aug 20, 2012 · This is a mockup of the search I'm running, with field names obviously simplified: index=myindex earliest=-24h | stats count (SomeText) as textCount by SomeText host | stats values (textCount) as Count,values (SomeText) as "Text" by host What am I missing? How can I marry up the # of times a message appears with that message? Thanks for any ideas. vwkbsc jtmkix vqq zdkjht qwdbu angr ilemgpw ydos oba fmht fav oqn zpga xwqyf nwzwm