Returning events that have matching fields but on different days

[djohnson99]

Hi there

Trying to track down events that have a condition where they appear on days different to one another.

E.g. if I have 5 events that have field ID=foo that all appear on the same day (e.g. Monday) and another 5 that have ID=bar but are spread out over several days (e.g. Monday, Thursday, Saturday) I only want to return the ID=bar results.

Basically want to do this for any events with matching ID's that repeatedly occur on multiple different days.

What would be the best way to do this?

[djohnson99]

So I've tried this with " |fields ID _time" and it seems to be returning the ones I don't want (e.g. five events on the same day)

[michel_wolf]

If you just want to group all events by the same ID in your timerange you can use

|stats values(*) as * by ID

If you need to group them in different days you can to do:

|bin span=1d _time
|stats values(*) as * by ID _time

[michel_wolf]

Hey Johnson,

I would try something like this

index=<your_index> ID=*

|bin span=1d _time

|fields <all your fields> _time

|stats values(*) as * by ID