index=active_directory | eventstats count by useraccount | search count=1
The above returning events for a unique field value of useraccount. What I am looking for is events with a unique user account grouped with several of another field value. Have tried transaction command to no avail.
Pointing in the right direction is greatly appreciated.
index=active_directory | stats values(process_name) count by user
grouped with several of another field value.
What's the fields?
So one useraccount with many processes accessed , process_name being many different values
Is this closer to what you are looking for?
index=active_directory | stats values(process_name) by user
Yes this works!
I just added a count
| stats count values(process_name) by user
Great, I'll post it as an answer so you can accept it.
After testing it out, it is returning on a single process_name value given the threshold.
So instead of returning results where one user is seen with many process_name values it groups a user with any process_name value
Hopefully this came across clearly
something like this?
index=active_directory | stats distinct_count(user) as distinct_count by host | where distinct_count=1