How to return false if all results for a user are the same

[DevNull]

Hi there

I am trying to construct a search query which checks the ASN a user logs in from within a time period.

I would like to exclude all results where the ASN value is the same for all logins for a user.

Is there a way to do a compare of results based on both user and ASN within one search?

[gcusello]

Hi @DevNull,

let me understand:

• ASN is a field that could have many values and sometimes there could be the same value for a user,
• you want to exclude users where there are more equal results on the same user,

is this correct?

In this case you can use stats and the option distinct_count, something like this:

your_search
| stats dc(ASN) AS dc_ASN values(ASN) AS ASN BY user
| where dc_ASN>threeshold

where threeshold is a number.

Ciao.

Giuseppe