How to edit my eventstats search to keep only non-unique events?

[rlough]

Hey there,

I currently have a query that compares a field to two sources. What I want is to be able to only keep fields with the same value across the events.

Here's what I have:

index=* source=src1.log OR source=src2.log | eventstats dc(source) as source_count by FIELD_NAME | where source_count = 1

The above works, but keeps the unique FIELD_NAME values. Is there a way to do the opposite?

Ex:
src1.log
FIELD_NAME = name1
FIELD_NAME = name2

src2.log
FIELD_NAME = name3
FIELD_NAME = name2

RESULT EVENTS
FIELD_NAME = name2

Thank you in advance!

[martin_mueller · Accepted solution]

Replace the 1 with a 2 to get FIELD_NAME values that have two distinct source values, ie exist in both sources.