Problem indexing with hyperUnique


I’ve moved past the quickstart and am working on indexing and querying my own data. It’s going well so far, but I’m having trouble with hyperUnique.

Use case: my event data contains an IP address field. I’d like to be able to count the UNIQUE IP addresses in a query, but don’t need to retain the individual values.

Inside metricsSpec I have: { “name” : “ip_unique”, “type” : “hyperUnique”, “fieldName” : “ip” }

In my query: “aggregations”: [ { “type”: “longSum”, “fieldName”: “ip_unique”, “name”: “ip_unique” } ]

Sample field from my input: “ip”:“”

Every query I run just has ZERO for ip_unique. I’m sure I’m missing something obvious here, any pointers would be appreciated.

Thank you! -Aaron

You also need to use the hyperUnique aggregator in the query.

And I was indeed missing something obvious! Thank you for the pointer, the query works terrifically now.