https://community.splunk.com/t5/Splunk-Search/How-to-return-a-field-that-isn-t-part-of-the-stats-count/m-p/249653#M74510 <P>Try this</P> <PRE><CODE>.... | stats values(loginid) as lid count by sessionid | where mvcount(lid)&gt;1 </CODE></PRE> Fri, 13 May 2016 11:22:38 GMT sundareshr 2016-05-13T11:22:38Z https://community.splunk.com/t5/Splunk-Search/How-to-return-a-field-that-isn-t-part-of-the-stats-count/m-p/249652#M74509 <P>Hi, </P> <P>I'm trying to get a table of all the Session_ID values when the count of Logon_IDs is more than 2, but since the stats count is based on the number of Logon_IDs, the Session_ID field is no longer available for me to <CODE>table</CODE>.</P> <P>For example:</P> <PRE><CODE>Data= Logon_IDs Session_ID Jones sess_1 Smith sess_2 Brown sess_3 Smith sess_4 </CODE></PRE> <P>My first attempt was <CODE>stats count BY Logon_IDs" | where count &gt; 1 | table Session_ID</CODE>, but this removes the Session_ID field.</P> <P>What SPL should I be using to get the result:</P> <PRE><CODE>Session_ID sess_2 sess_4 </CODE></PRE> <P>Many thanks,<BR /> Mark.</P> Tue, 29 Sep 2020 09:42:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-return-a-field-that-isn-t-part-of-the-stats-count/m-p/249652#M74509 markwymer 2020-09-29T09:42:16Z https://community.splunk.com/t5/Splunk-Search/How-to-return-a-field-that-isn-t-part-of-the-stats-count/m-p/249653#M74510 <P>Try this</P> <PRE><CODE>.... | stats values(loginid) as lid count by sessionid | where mvcount(lid)&gt;1 </CODE></PRE> Fri, 13 May 2016 11:22:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-return-a-field-that-isn-t-part-of-the-stats-count/m-p/249653#M74510 sundareshr 2016-05-13T11:22:38Z