https://community.splunk.com/t5/Splunk-Search/How-to-chart-values-only-where-2-or-more-values-are-returned/m-p/111764#M29300 <P>Try this:</P> <P><CODE>| chart count, values(status) as allStatuses by user | where mvcount(allStatuses) &gt; 1</CODE></P> Thu, 04 Sep 2014 16:52:45 GMT aweitzman 2014-09-04T16:52:45Z https://community.splunk.com/t5/Splunk-Search/How-to-chart-values-only-where-2-or-more-values-are-returned/m-p/111763#M29299 <P>I am using a chart function as follows: </P> <P>| chart count, values(status) by user</P> <P>and I only want to get back the results that have 2 or more statuses. I have tried some eval commands but I haven't gotten anything to work properly. </P> Thu, 04 Sep 2014 16:11:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-chart-values-only-where-2-or-more-values-are-returned/m-p/111763#M29299 ulikabbq 2014-09-04T16:11:07Z https://community.splunk.com/t5/Splunk-Search/How-to-chart-values-only-where-2-or-more-values-are-returned/m-p/111764#M29300 <P>Try this:</P> <P><CODE>| chart count, values(status) as allStatuses by user | where mvcount(allStatuses) &gt; 1</CODE></P> Thu, 04 Sep 2014 16:52:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-chart-values-only-where-2-or-more-values-are-returned/m-p/111764#M29300 aweitzman 2014-09-04T16:52:45Z https://community.splunk.com/t5/Splunk-Search/How-to-chart-values-only-where-2-or-more-values-are-returned/m-p/111765#M29301 <P>you can use the distinct count too</P> <P><CODE>| chart count, values(status) as allStatuses, dc(status) AS distinct_statuses by user | where distinct_statuses &gt; 1 | fields - distinct_statuses</CODE></P> Thu, 04 Sep 2014 17:02:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-chart-values-only-where-2-or-more-values-are-returned/m-p/111765#M29301 yannK 2014-09-04T17:02:29Z