If I have 3 months of data, how do I write a search to return repeating values that appear in all 3 months?

[thambisetty]

Hi,

I have data like below:

Day month Signature
10 oct trojan
11 oct abc
12 oct efg
10 nov abc
11 nov efg
11 dec efg

I have 3 months of data and I want to check which signature is repeating for those 3 months so that my output will be "efg" since it is there for 3 months.

Please help me on this.

[srinathd]

try this "stats count by signature | where count >=3"