https://community.splunk.com/t5/Splunk-Search/Stats-count-by-set-to-specific-count/m-p/529966#M149714 Small fix as <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/228799">@bcjammer03</a> asked "triggered twice" you should use "| where count = 2" Wed, 18 Nov 2020 16:41:50 GMT isoutamo 2020-11-18T16:41:50Z https://community.splunk.com/t5/Splunk-Search/Stats-count-by-set-to-specific-count/m-p/529943#M149707 <P>I'm trying to create a query where I get results of a specific user triggering two of the same alerts. Is there a way to set 'stats count by' to equal 2, that results will show only users that have triggered this alert twice?</P><P>Or is there a specific command that will allow me to do this?</P><P>index=`email` action=blocked | stats count by user_ID</P> Wed, 18 Nov 2020 15:37:57 GMT https://community.splunk.com/t5/Splunk-Search/Stats-count-by-set-to-specific-count/m-p/529943#M149707 bcjammer03 2020-11-18T15:37:57Z https://community.splunk.com/t5/Splunk-Search/Stats-count-by-set-to-specific-count/m-p/529965#M149713 <P>There is no specific command for that, but there is a simple combination of commands.</P><LI-CODE lang="markup">index=`email` action=blocked | stats count by user_ID | where count &gt; 1</LI-CODE> Wed, 18 Nov 2020 16:36:42 GMT https://community.splunk.com/t5/Splunk-Search/Stats-count-by-set-to-specific-count/m-p/529965#M149713 richgalloway 2020-11-18T16:36:42Z https://community.splunk.com/t5/Splunk-Search/Stats-count-by-set-to-specific-count/m-p/529966#M149714 Small fix as <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/228799">@bcjammer03</a> asked "triggered twice" you should use "| where count = 2" Wed, 18 Nov 2020 16:41:50 GMT https://community.splunk.com/t5/Splunk-Search/Stats-count-by-set-to-specific-count/m-p/529966#M149714 isoutamo 2020-11-18T16:41:50Z https://community.splunk.com/t5/Splunk-Search/Stats-count-by-set-to-specific-count/m-p/529968#M149715 <P>yes! thank you&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>&nbsp;</P> Wed, 18 Nov 2020 16:46:51 GMT https://community.splunk.com/t5/Splunk-Search/Stats-count-by-set-to-specific-count/m-p/529968#M149715 bcjammer03 2020-11-18T16:46:51Z https://community.splunk.com/t5/Splunk-Search/Stats-count-by-set-to-specific-count/m-p/529990#M149722 <P>That is a more precise match to the requirements, but I presumed "thrice" is just as interesting as "twice".</P><P>If your problem is resolved, then please click the "Accept as Solution" button to help future readers.</P> Wed, 18 Nov 2020 18:46:32 GMT https://community.splunk.com/t5/Splunk-Search/Stats-count-by-set-to-specific-count/m-p/529990#M149722 richgalloway 2020-11-18T18:46:32Z