Hi, I seem to be stuck with something pretty trivial. I have events with users and corresponding hostnames, eg:
User | Hostname |
user1 | hostA |
user1 | hostB |
user2 | hostA |
user2 | hostC |
user3 | hostD |
I want to count unique user-hostname values and show the contributing hostnames for users that have used more that 1 hostname like this:
User | Hostnames used |
user1 | hostA hostB |
user2 | hostA hostC |
This seems to take care of the first part of the task:
| stats dc(Hostname) as uh by User
| search uh > 1
How can I add the contributing Hostnames?
Formatting is not so important - it may be one field with all the hostnames like in the example above, or multiple fields, or one field together with the User field.
Thank you.
| stats values(hostname) as hostnames by User
| eval uh=mvcount(hostnames)
| where uh > 1
| stats values(hostname) as hostnames by User
| eval uh=mvcount(hostnames)
| where uh > 1
Thank you! 🙂