How to display events in table format when same value appears multiple times?

[rkeq0515]

Is there a way to display events in a table when the same value appears multiple times with other values?
I am looking for user accounts that appear on two or more systems.

The following is a list of records:

field1 | field2 | field3
sys1 | user1 | somevalue1 <<-- Want to grab this row
sys2 | user2 | somevalue2
sys2 | user2 | somevalue3
sys2 | user2 | somevalue4
sys2 | user1 | somevalue2 <<-- Want to grab this row

I have been trying different queries based off of the follow but I cant seem to get the correct syntax. I can get a count on field 1 and/or field 2, but I am not able to pull just those events listed above and the attributes accompanying (field3, field4, etc.) the events.

1. index="myindex"
2. | stats count by field1 field2
3. | where count > 1
4. | table count field1 field2 field3
5. | sort - count

[to4kawa · Accepted solution]

 index="myindex"
| eventstats dc(field1) as counts by field2
| where counts > 1
| table as_you_like

How about this?