Is there a way to display events in a table when the same value appears multiple times with other values?
I am looking for user accounts that appear on two or more systems.
The following is a list of records:
field1 | field2 | field3
sys1 | user1 | somevalue1 <<-- Want to grab this row
sys2 | user2 | somevalue2
sys2 | user2 | somevalue3
sys2 | user2 | somevalue4
sys2 | user1 | somevalue2 <<-- Want to grab this row
I have been trying different queries based off of the follow but I cant seem to get the correct syntax. I can get a count on field 1 and/or field 2, but I am not able to pull just those events listed above and the attributes accompanying (field3, field4, etc.) the events.
1.
index="myindex"
2.
| stats count by field1 field2
3.
| where count > 1
4.
| table count field1 field2 field3
5.
| sort - count
index="myindex"
| eventstats dc(field1) as counts by field2
| where counts > 1
| table as_you_like
How about this?
index="myindex"
| eventstats dc(field1) as counts by field2
| where counts > 1
| table as_you_like
How about this?