There are various event codes like eventID = "123" , eventID ="456", eventID = "789" . There are some "appID" fields that occurs in both eventID = "123" AND eventID ="456" (not all "appID" occur in both these eventID) . So I want to display a list of values from all those "appID" field which are occurring in both the eventID = "123" AND eventID ="456" .
Please let me know how can I achieve it. I also have a large data set here.
Thank you.
Try something like this
| eventstats values(eventID) as eventids by appID
| where match(eventids, "123") AND match(eventids,"456")