Filtering based on quantity of list() results

[Sam2]

Hello all,

I have this search:

...| streamstats window=1 global=false current=f last(_time) as next_time by cs_host,username| eval gap = next_time - _time |search gap>350| stats list(gap) by cs_host,username

which draws a nice table, grouped by list(gap). However, I'd like to remove any rows in the table that only have one results of list(gap), but am struggling with the syntax. Can anyone help please?

[martin_mueller · Accepted solution]

How about this:

... | streamstats window=1 global=false current=f last(_time) as next_time by cs_host,username| eval gap = next_time - _time | search gap>350 | stats count list(gap) by cs_host username | where count > 1

[Sam2]

Yes, that works! I think I was trying to over complicate it!