Using event count with a table

[thisemailwillbe]

Hi all,

Here is my current search:

source=health.log REGION=region1 STATE=down TYPE=type1

What I want to do: I want the table to only display results if the region/state/type combination has happened 5 times in the past hour.

I tried using stats count, but I couldn't get it to work and also use table to output the multiple fields.

I must be not understanding something because this seems like it should be fairly easy to do...

[ITWhisperer · Accepted solution]

source=health.log REGION=region1 STATE=down TYPE=type1
| stats count by REGION STATE TYPE
| where count >= 5

or, if you want the events which are included in these stats

source=health.log REGION=region1 STATE=down TYPE=type1
| eventstats count by REGION STATE TYPE
| where count >= 5

[thisemailwillbe]

Thanks! This was a really easy solution, I don't know why I didn't think of doing multiple fields...