How to do show only count result that is not equal base on two fields

[hitman88]

Here is my query for checking BGP routing that goes UP and DOWN. (I only want to see when the amount of UP and DOWN are not equal for the same Neighbor on a router)

In my case i want to show only line #5 and #6.

How do i do that ? 

My query:

...... | rex field=_raw "(?<BGP_NEIGHBOR>neighbor\s\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"  |  rex field=_raw "(?<BGP_STATUS>(Up|Down))"  |  stats count by HOST, BGP_NEIGHBOR, BGP_STATUS

#     HOST               BGP_NEIGHBOR       BGP_STATUS       count

1     Router A          neighbor 10.1.1.1          Down                    1

2     Router A          neighbor 10.1.1.1          Up                          1

3     Router B          neighbor 10.2.2.2          Down                   1

4     Router B          neighbor 10.2.2.2          Up                         1

5     Router C          neighbor 10.3.3.3         Down                    2

6     Router C          neighbor 10.3.3.3         Up                          1

7     Router D          neighbor 10.4.4.4         Down                   2

8     Router D          neighbor 10.4.4.4         Up                         2

[yuanliu]

Something like this?

| eventstats range(count) as varies by HOST
| where varies > 0

Here is an emulation you can play with and compare with real data. (I know that # is not a real field.  It doesn't affect calculation here.)

| makeresults format=csv data="#,HOST,BGP_NEIGHBOR,BGP_STATUS,count
1,Router A,neighbor 10.1.1.1,Down,1
2,Router A,neighbor 10.1.1.1,Up,1
3,Router B,neighbor 10.2.2.2,Down,1
4,Router B,neighbor 10.2.2.2,Up,1
5,Router C,neighbor 10.3.3.3,Down,2
6,Router C,neighbor 10.3.3.3,Up,1
7,Router D,neighbor 10.4.4.4,Down,2
8,Router D,neighbor 10.4.4.4,Up,2"
``` the above emulates
.....
| rex field=_raw "(?<BGP_NEIGHBOR>neighbor\s\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| rex field=_raw "(?<BGP_STATUS>(Up|Down))"
| stats count by HOST, BGP_NEIGHBOR, BGP_STATUS
```

Combining this with the above search gives

#	BGP_NEIGHBOR	BGP_STATUS	HOST	count	varies
5	neighbor 10.3.3.3	Down	Router C	2	1
6	neighbor 10.3.3.3	Up	Router C	1	1

[hitman88]

Thank you  yuanliu 
It is working   😊