Hi all!
I have a table as a search result:
date Country cs_username
2018-06-12 Mexico mendoza
2018-06-12 Mexico mendoza
2018-06-12 Mexico mendoza
2018-06-14 Mexico mendoza
2018-06-20 Mexico mendoza
2018-06-22 Mexico mendoza
2018-06-25 Mexico mendoza
2018-06-26 Mexico mendoza
2018-06-26 Mexico mendoza
2018-06-11 Netherlands xing
2018-06-11 United States xing
2018-06-11 Nigeria xing
2018-06-13 United States xing
2018-06-14 United States xing
2018-06-15 United States xing
2018-06-17 United States xing
2018-06-22 Brazil xing
2018-06-24 United States xing
2018-06-25 Brazil xing
2018-06-25 Brazil xing
2018-06-25 United States xing
2018-06-17 China xue
2018-06-18 China xue
2018-06-20 China xue
2018-06-21 China xue
2018-06-22 China xue
2018-06-22 China xue
2018-06-22 Brazil xue
Note that to the same days I have the same user and 2 different Countries.
2018-06-11 xing
2018-06-25 xing
2018-06-22 xue
This is the condition that I have interest.
I need to filter the table results to show just this:
2018-06-11 Netherlands xing
2018-06-11 United States xing
2018-06-11 Nigeria xing
2018-06-25 Brazil xing
2018-06-25 Brazil xing
2018-06-25 United States xing
2018-06-22 China xue
2018-06-22 China xue
2018-06-22 Brazil xue
Can anyone help me?
Thanks a lot!
Add this to your current search:
| eventstats dc(Country) as count by cs_username,date
| where count>1
Add this to your current search:
| eventstats dc(Country) as count by cs_username,date
| where count>1
Great!
Thank you FrankVI.