How to extract common values from a multi-value field for different event times.

[ashishdhinwa]

Hi All,

I have a multi-value field as shown below-

_time	field_test
2022-05-13 04:36:00	test_data_1
	test_data_2
	test_data_3
	test_data_4
2022-05-13 03:30:00	test_data_9
	test_data_10
	test_data_3
	test_data_4

For the above two events, I am trying to write a query which can provide me the common values such that result is-

test_data_3

test_data_4

Please help me on how can I accomplish it?

[VatsalJagani]

@ashishdhinwa - You can try something like

<your query>
| eventstats dc(_time) as total_count
| mvexpand field_test
| stats count, last(total_count) as total_count by field_test
| where field_test>=total_count
| fields field_test

This should provide values that are common for all the _time field values (present in all events).

Hope this helps!!!

[ITWhisperer · Accepted solution]

| stats count by field_test
| where count > 1

[ashishdhinwa]

Thanks! This works 🙂