https://community.splunk.com/t5/Splunk-Search/Query-to-find-events-with-more-than-2-values-for-a-specific/m-p/538173#M152117 <P>I'm trying to create a query to show me all users who have purchased more than 1 type of product.</P><P>Each event has a "user" field and a "product" field.&nbsp; I only want to see the users that have purchased more than 1 type of product.</P><P>"| stats count by user product"&nbsp;</P><P>This shows me all user and product combinations, but don't know how to filter all events where a user only purchased one type of product.</P><P>I feel that it should be a very simple query, but can't seem to figure it out.</P> Mon, 01 Feb 2021 21:18:46 GMT john_byun 2021-02-01T21:18:46Z https://community.splunk.com/t5/Splunk-Search/Query-to-find-events-with-more-than-2-values-for-a-specific/m-p/538173#M152117 <P>I'm trying to create a query to show me all users who have purchased more than 1 type of product.</P><P>Each event has a "user" field and a "product" field.&nbsp; I only want to see the users that have purchased more than 1 type of product.</P><P>"| stats count by user product"&nbsp;</P><P>This shows me all user and product combinations, but don't know how to filter all events where a user only purchased one type of product.</P><P>I feel that it should be a very simple query, but can't seem to figure it out.</P> Mon, 01 Feb 2021 21:18:46 GMT https://community.splunk.com/t5/Splunk-Search/Query-to-find-events-with-more-than-2-values-for-a-specific/m-p/538173#M152117 john_byun 2021-02-01T21:18:46Z https://community.splunk.com/t5/Splunk-Search/Query-to-find-events-with-more-than-2-values-for-a-specific/m-p/538175#M152118 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/204250">@john_byun</a>,</P><P>Please try below;</P><LI-CODE lang="markup">| stats dc(product) as count by user | where count&gt;1</LI-CODE><P>&nbsp;</P> Mon, 01 Feb 2021 21:24:45 GMT https://community.splunk.com/t5/Splunk-Search/Query-to-find-events-with-more-than-2-values-for-a-specific/m-p/538175#M152118 scelikok 2021-02-01T21:24:45Z https://community.splunk.com/t5/Splunk-Search/Query-to-find-events-with-more-than-2-values-for-a-specific/m-p/538177#M152119 <P>Perfect!&nbsp; Thanks for your help.</P> Mon, 01 Feb 2021 21:36:19 GMT https://community.splunk.com/t5/Splunk-Search/Query-to-find-events-with-more-than-2-values-for-a-specific/m-p/538177#M152119 john_byun 2021-02-01T21:36:19Z