Allow the .dat file to use column indices to extract just the unique
values from that column.

Examples

To use the last column last column (the default) as the data source for
the src_ip attribute:

    es-search.pl src_ip:malicious_convos.dat[-1]

To use the first column last column as the data source for the src_ip
attribute:

    es-search.pl src_ip:malicious_convos.dat[0]
Allow sub aggregation sorting of aggregated data.  This will
automatically switch the aggregation method from 'facets' to
'aggregations' which *CAN* cause memory issues.  Use at your own risk!

To search for the top src_ip's in the US by the number of distinct acct's
attributed to them:

    es-search.pl src_ip_country:US --top src_ip --by cardinality:@fields.acct