I have a table generated from two fields, sessionid and host -
... | stats count by sessionid host
I am trying to find only the sessionids that appear on more than one host. So basically, I need to compare each sessionid/host pair that appears in the logs with subsequent pairs for the same sessionid, but a different host.
This will give you what you are looking for.
... | transaction pdsessionid maxspan=30s maxpause=5s | eval hcount = mvcount(host) | where hcount > 1
... | stats count by sessionid host | eventcount dc(host) as hc by sessionid | where hc >= 2
or you could do:
... | values(host) as hosts by sessionid | where mvcount(hosts) >= 2
but that gives you a less flexible set of results.