Hi, I seem to be stuck with something pretty trivial. I have events with users and corresponding hostnames, eg:
I want to count unique user-hostname values and show the contributing hostnames for users that have used more that 1 hostname like this:
This seems to take care of the first part of the task:
| stats dc(Hostname) as uh by User | search uh > 1
How can I add the contributing Hostnames?
Formatting is not so important - it may be one field with all the hostnames like in the example above, or multiple fields, or one field together with the User field.