Search based on field value occurances

[jturnerrdba]

I'm trying to define a search that would output only the events that are related to a value of a field that occur at least X number of times.

So for instance, If I have a field named "Username" and a list of 100 events that contain that field. For sake of argument we'll say that there are 10 users that would display as values for the field "username". Lets also say that I have 2 users, "Bob" and "Mike", that show up more than 10 times each. I want a search that would output all events that contained "Bob" and "Mike" as values of "Username" based off the fact that there are more than 10 events for those users.

[kristian_kolb · Accepted solution]

your base search here | eventstats count by Username | where count>10

Ought to work.

/Kristian

[jturnerrdba]

That works perfectly, and much simpler than I thought it would be. Thanks very much.