Hello @avi95022,
Are you using Flux or InfluxQL?
I use this script query remote_addr count:
from(bucket: "accesslogs")
|> range(start: v.timeRangeStart, stop: v.timeRangeStop)
|> filter(fn: (r) => r["_measurement"] == "accesslogs")
|> filter(fn: (r) => r["_field"] == "remote_addr")
|> duplicate(column: "_value", as: "remote_addr")
|> group(columns: ["remote_addr"])
|> count()
from(bucket: v.bucket)
|> range(start: v.timeRangeStart, stop: v.timeRangeStop)
|> filter(fn: (r) => r["_measurement"] == "suricata-alerts")
|> filter(fn: (r) => r["_field"] == "alert_metadata_signature_severity_0")
|> duplicate(column: "_value", as: "new_column")
|> group(columns: ["new_column"])
|> count()
[/quote]