Aggregations: count, unique count, top values

What is it?

An aggregation summarizes many documents. Count totals them; unique count (cardinality) counts distinct values of a field; the terms aggregation lists the top values by count. Grouping 'by' a field gives you one summary row per entity.

Why it matters

This is Module 3 of Splunk in Elastic clothing. count is stats count; unique count is dc(); top values is top. The anomaly — one source hitting 60 accounts, one host talking to 300 domains — appears only when you aggregate.

Where you see it

In Lens or an aggregation-based visualization: 'unique count of user.name, split by source.ip' shows how many distinct accounts each source touched (password spray); 'count, split by user.name' shows volume per account (brute force).

What normal looks like

A smooth distribution: most sources touch one or two accounts, most accounts have a handful of events. No single bar dominates the chart.

What suspicious looks like

One bar far off the distribution: a source with unique count of user.name = 60 (spray), an account with count = 400 (brute force), a host with unique count of destination = 300 (scanning or beaconing).

How analysts investigate

Choose the metric that reveals the technique (count for volume, unique count for spread), split by the entity that would carry it, and sort so the outlier rises to the top — exactly the reflex you built in Splunk.

Common beginner mistakes

Confusing count with unique count — 400 failures against one account is not 400 accounts attacked.
Forgetting to split by a field, so you see one grand total instead of a per-entity breakdown.

count for volume, unique count for spread

  Splunk → Elastic, same idea:
    stats count            → Count metric
    stats dc(user)         → Unique count of user.name (cardinality)
    top parent_process     → Top values (terms aggregation)

  Unique count of user.name, split by source.ip:
    203.0.113.90  → 60   ← password spray (one source, many accounts)
  Count, split by user.name:
    a.hakim       → 412  ← brute force (volume on ONE account)

Elastic aggregations map one-to-one onto the Splunk stats you already know.

Quick check

To detect a password spray (one source, many distinct accounts) in Elastic, which aggregation split by source.ip?

A quick self-check — it doesn't affect your XP or progress.