Can I count lines in table cell?

[yossefn]

Hi,

I have a search to show the number of times an IP address was trying to reach some Customer IDs.
How can I count the number of CustIds and present just if there are more than 2 in a cell?

Attached the search and results:

original search
| stats count by CustId, IpAddress
| search count>10
| sort -count
| stats list(CustId) as CustId, list(count) as Count, sum(count) as Total by IpAddress
| sort -Total
| head 10

---

IpAddress            CustId Count   Total
62.90.19.22           306352113 84  84

84.28.28.232          60555283   70 84
                      23070955   14

141.26.208.180      32370266     42 73
                      205539923 31

[richgalloway · Accepted solution]

Use mvcount.

| stats count by CustId, IpAddress
| search count>10
| stats list(CustId) as CustId, list(count) as Count, sum(count) as Total by IpAddress
| where mvcount(CustId) > 1
| sort 10 - Total

[yossefn]

Working great, thank you!