Suppose we are inquiry id as 1,2,3,4,5,6,7,8,9,10 and these are assigned to some person p1,p2,p3,p4.
Then 1,2,3,5 inquiry is assigned to p1 , 4,6 assigned to p2,7,8,9, assigned to p3 and 10 assigned to p4.
So the question is how to display person's having more than 1 inquiry assigned to them.
And we do not know about person name and inquiry,It is just present in database.
@pal_sumit1, without details like sample data and field names and your existing query etc. it is difficult to assist you. However, based on your question seems like you are asking for something like the following. PS: dc()
aggregate function gives distinct count.
<yourbasesearch> person=* inquiry=*
| stats dc(inquiry) as inquiryCount by person
| search inquiryCount >1
Yes,you are right,I am also doing like this.But is there is another way to do this?
Could you please let us know the reason to look for another way to do this? Is there performance issue or different use case?
To me it seems correct way to identify persons you are interested in. You can also use values()
to show unique values of inquiries
<yourbasesearch> person=* inquiry=*
| stats dc(inquiry) as inquiryCount values(inquiry) as inquiries by person
| search inquiryCount >1
@pal_sumit1 if this addresses your need, please accept the answer to mark this question as answered. If not please let us know any further queries that you may have!