Query to find events with more than 2 values for a specific field compared to another field

[john_byun]

I'm trying to create a query to show me all users who have purchased more than 1 type of product.

Each event has a "user" field and a "product" field.  I only want to see the users that have purchased more than 1 type of product.

"| stats count by user product" 

This shows me all user and product combinations, but don't know how to filter all events where a user only purchased one type of product.

I feel that it should be a very simple query, but can't seem to figure it out.

[scelikok · Accepted solution]

Hi @john_byun,

Please try below;

| stats dc(product) as count by user
| where count>1

[john_byun]

Perfect!  Thanks for your help.