Search to compare fields where field1 has both entries in field2?

[karthik4455]

I wish to run a query where I need to see if field1 has both entries in field2. Ex: I need to query the results like A & E which has both Escalated and Closed status.

Field status
A Escalated
A Closed
B Closed
C Escalated
D Escalated
E Escalated
E Closed

[somesoni2 · Accepted solution]

Try this

your base search giving fields 'Field' and 'status' | eventstats  count(status) as statusCount by Field | where statusCount > 1

Update

Give this a try

 your base search giving fields 'Field' and 'status' | stats values(status) as status by Field delim=" & " | where mvcount(status) > 1 | nomv status

[karthik4455]

Thanks a lot. It worked.

[somesoni2]

Try the updated answer.

[karthik4455]

Can you tell me how I can filter the output as follows:
You could notice the output doesn't have B,C & D because they should be dropped.

A Escalated & Closed
E Escalated & Closed