'Stats count by' set to specific count?

[bcjammer03]

I'm trying to create a query where I get results of a specific user triggering two of the same alerts. Is there a way to set 'stats count by' to equal 2, that results will show only users that have triggered this alert twice?

Or is there a specific command that will allow me to do this?

index=`email` action=blocked | stats count by user_ID

[richgalloway]

There is no specific command for that, but there is a simple combination of commands.

index=`email` action=blocked 
| stats count by user_ID
| where count > 1

[bcjammer03]

yes! thank you @richgalloway 

[isoutamo]

Small fix as @bcjammer03 asked "triggered twice" you should use "| where count = 2"

[richgalloway]

That is a more precise match to the requirements, but I presumed "thrice" is just as interesting as "twice".

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.