https://community.splunk.com/t5/Splunk-Search/How-to-display-events-in-table-format-when-same-value-appears/m-p/464144#M130820 <P>Is there a way to display events in a table when the same value appears multiple times with other values?<BR /> I am looking for user accounts that appear on two or more systems.</P> <P>The following is a list of records:</P> <P>field1 | field2 | field3<BR /> <STRONG>sys1 | user1</STRONG> | somevalue1 &lt;&lt;-- Want to grab this row<BR /> sys2 | user2 | somevalue2<BR /> sys2 | user2 | somevalue3<BR /> sys2 | user2 | somevalue4<BR /> <STRONG>sys2 | user1</STRONG> | somevalue2 &lt;&lt;-- Want to grab this row</P> <P>I have been trying different queries based off of the follow but I cant seem to get the correct syntax. I can get a count on field 1 and/or field 2, but I am not able to pull just those events listed above and the attributes accompanying (field3, field4, etc.) the events.</P> <P><CODE>1.</CODE> index="myindex"<BR /> <CODE>2.</CODE> | stats count by field1 field2<BR /> <CODE>3.</CODE> | where count &gt; 1<BR /> <CODE>4.</CODE> | table count field1 field2 field3 <BR /> <CODE>5.</CODE> | sort - count</P> Fri, 22 May 2020 21:07:22 GMT rkeq0515 2020-05-22T21:07:22Z https://community.splunk.com/t5/Splunk-Search/How-to-display-events-in-table-format-when-same-value-appears/m-p/464144#M130820 <P>Is there a way to display events in a table when the same value appears multiple times with other values?<BR /> I am looking for user accounts that appear on two or more systems.</P> <P>The following is a list of records:</P> <P>field1 | field2 | field3<BR /> <STRONG>sys1 | user1</STRONG> | somevalue1 &lt;&lt;-- Want to grab this row<BR /> sys2 | user2 | somevalue2<BR /> sys2 | user2 | somevalue3<BR /> sys2 | user2 | somevalue4<BR /> <STRONG>sys2 | user1</STRONG> | somevalue2 &lt;&lt;-- Want to grab this row</P> <P>I have been trying different queries based off of the follow but I cant seem to get the correct syntax. I can get a count on field 1 and/or field 2, but I am not able to pull just those events listed above and the attributes accompanying (field3, field4, etc.) the events.</P> <P><CODE>1.</CODE> index="myindex"<BR /> <CODE>2.</CODE> | stats count by field1 field2<BR /> <CODE>3.</CODE> | where count &gt; 1<BR /> <CODE>4.</CODE> | table count field1 field2 field3 <BR /> <CODE>5.</CODE> | sort - count</P> Fri, 22 May 2020 21:07:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-events-in-table-format-when-same-value-appears/m-p/464144#M130820 rkeq0515 2020-05-22T21:07:22Z https://community.splunk.com/t5/Splunk-Search/How-to-display-events-in-table-format-when-same-value-appears/m-p/464145#M130821 <PRE><CODE> index="myindex" | eventstats dc(field1) as counts by field2 | where counts &gt; 1 | table as_you_like </CODE></PRE> <P>How about this?</P> Sat, 23 May 2020 00:09:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-events-in-table-format-when-same-value-appears/m-p/464145#M130821 to4kawa 2020-05-23T00:09:08Z