I'm trying to create a query where I get results of a specific user triggering two of the same alerts. Is there a way to set 'stats count by' to equal 2, that results will show only users that have triggered this alert twice?
Or is there a specific command that will allow me to do this?
index=`email` action=blocked | stats count by user_ID
There is no specific command for that, but there is a simple combination of commands.
index=`email` action=blocked
| stats count by user_ID
| where count > 1
yes! thank you @richgalloway
That is a more precise match to the requirements, but I presumed "thrice" is just as interesting as "twice".
If your problem is resolved, then please click the "Accept as Solution" button to help future readers.