Removing events based on condition

[kamlesh_vaghela · Accepted solution]

@PrisonMike 

Are you looking for this?

| stats values(Field1) as Field1, count(Field1) as count by Field2 _time
| where count=1

KV