Now ,I want to get common values from data.
I use this command:
`index="new_1" |stats list(oper_field) as gn by department
Now ,I want to get a column to show values which count >=2
For example :
there have two "Model List" . I want to show it in another column
Please help me
| eventstats count by oper_field ,department| where count > 1 | stats list(oper_field) as gn by department
| eventstats count by oper_field ,department| where count > 1 | stats list(oper_field) as gn by department
what do you need me to offer you, my data or a sample of the results is shown ?
Sample input and output
Thank you!
Now I have another question,can you help me?
I want get data which accounted for the largest proportion . such as ,there are two "Model List" ,and all of data are three, the "Model List" is the largest proportion,what should I do?
Can you give me an example?