Hi @kuriakose ,
if for each aid you have always two events and you wabt to find when the two values are different, you could use the following approach:
your_search
| stats dc(SHA) AS n_SHA values(SHA) AS SHA BY aid
| where dc_SHA>1
| table aid SHA
adapt this approach to your Use Case.
Ciao.
Giuseppe
Hi @kuriakose ,
if for each aid you have always two events and you wabt to find when the two values are different, you could use the following approach:
your_search
| stats dc(SHA) AS n_SHA values(SHA) AS SHA BY aid
| where dc_SHA>1
| table aid SHA
adapt this approach to your Use Case.
Ciao.
Giuseppe