How to filter table results?

pierre_weg — Wed, 27 Jun 2018 15:13:06 GMT

Hi all!

I have a table as a search result:

date    Country cs_username
2018-06-12  Mexico  mendoza
2018-06-12  Mexico  mendoza
2018-06-12  Mexico  mendoza
2018-06-14  Mexico  mendoza
2018-06-20  Mexico  mendoza
2018-06-22  Mexico  mendoza
2018-06-25  Mexico  mendoza
2018-06-26  Mexico  mendoza
2018-06-26  Mexico  mendoza
2018-06-11  Netherlands xing
2018-06-11  United States   xing
2018-06-11  Nigeria xing
2018-06-13  United States   xing
2018-06-14  United States   xing
2018-06-15  United States   xing
2018-06-17  United States   xing
2018-06-22  Brazil  xing
2018-06-24  United States   xing
2018-06-25  Brazil  xing
2018-06-25  Brazil  xing
2018-06-25  United States   xing
2018-06-17  China   xue
2018-06-18  China   xue
2018-06-20  China   xue
2018-06-21  China   xue
2018-06-22  China   xue
2018-06-22  China   xue
2018-06-22  Brazil  xue

Note that to the same days I have the same user and 2 different Countries.

 2018-06-11 xing
    2018-06-25 xing
    2018-06-22  xue

This is the condition that I have interest.
I need to filter the table results to show just this:

 2018-06-11 Netherlands xing
    2018-06-11  United States   xing
    2018-06-11  Nigeria xing
    2018-06-25  Brazil  xing
    2018-06-25  Brazil  xing
    2018-06-25  United States   xing
    2018-06-22  China   xue
    2018-06-22  China   xue
    2018-06-22  Brazil  xue

Can anyone help me?

Thanks a lot!

Re: How to filter table results?

FrankVl — Wed, 27 Jun 2018 15:39:26 GMT

Add this to your current search:

| eventstats dc(Country) as count by cs_username,date
| where count>1

Re: How to filter table results?

pierre_weg — Wed, 27 Jun 2018 16:41:31 GMT

Great!

Thank you FrankVI.

topic How to filter table results? in Splunk Search

How to filter table results?

Re: How to filter table results?

Re: How to filter table results?