Something like this?
| eventstats range(count) as varies by HOST
| where varies > 0
Here is an emulation you can play with and compare with real data. (I know that # is not a real field. It doesn't affect calculation here.)
| makeresults format=csv data="#,HOST,BGP_NEIGHBOR,BGP_STATUS,count
1,Router A,neighbor 10.1.1.1,Down,1
2,Router A,neighbor 10.1.1.1,Up,1
3,Router B,neighbor 10.2.2.2,Down,1
4,Router B,neighbor 10.2.2.2,Up,1
5,Router C,neighbor 10.3.3.3,Down,2
6,Router C,neighbor 10.3.3.3,Up,1
7,Router D,neighbor 10.4.4.4,Down,2
8,Router D,neighbor 10.4.4.4,Up,2"
``` the above emulates
.....
| rex field=_raw "(?<BGP_NEIGHBOR>neighbor\s\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| rex field=_raw "(?<BGP_STATUS>(Up|Down))"
| stats count by HOST, BGP_NEIGHBOR, BGP_STATUS
```
Combining this with the above search gives
# | BGP_NEIGHBOR | BGP_STATUS | HOST | count | varies |
5 | neighbor 10.3.3.3 | Down | Router C | 2 | 1 |
6 | neighbor 10.3.3.3 | Up | Router C | 1 | 1 |
Thank you yuanliu
It is working 😊