Try this
your base search giving fields 'Field' and 'status' | eventstats count(status) as statusCount by Field | where statusCount > 1
Update
Give this a try
your base search giving fields 'Field' and 'status' | stats values(status) as status by Field delim=" & " | where mvcount(status) > 1 | nomv status
Try this
your base search giving fields 'Field' and 'status' | eventstats count(status) as statusCount by Field | where statusCount > 1
Update
Give this a try
your base search giving fields 'Field' and 'status' | stats values(status) as status by Field delim=" & " | where mvcount(status) > 1 | nomv status
Thanks a lot. It worked.
Try the updated answer.
Can you tell me how I can filter the output as follows:
You could notice the output doesn't have B,C & D because they should be dropped.
A Escalated & Closed
E Escalated & Closed