stream_distinct_values: action, firewall.event.block

This data as json

col	value	n	rank
action	firewall.event.block	156088	10