field with exclusively one value

[monika0511]

here is how my base search output looks:

name	version	browser	runTime
call1	alpha	chrome	75
call1	beta	chrome	48
call2	alpha	firefox	30
call2	beta	chrome	78
call3	beta	firefox	56

I'm looking for a distinct list of "name, browser" that exclusively belongs to "beta" version. Getting count and median values is a bonus.

Here is the desired output:

name	version	browser	count(runTime)	median(runTime)
call2	beta	chrome	1	30
call3	beta	firefox	1	56

This is what I have so far: But this only gives me a diff. It can return alpha calls if those are not present in beta version. I'm looking for ONLY beta calls. 

baseSearch | stats dc(version) as found_in_versions BY name, platform | where found_in_versions < 2

 Any help would be appreciated!

[monika0511 · Accepted solution]

Here is how I was able to do it:

baseSearch | eval found_in_base_search=1 | append [ subSearch | eval found_in_sub_search=1 ] | eventstats values(found_in_base_search) AS found_in_base_search BY name | where isnull(found_in_base_search) AND isnotnull(found_in_sub_search) | stats count(runTime), median(runTime) by name, version

[richgalloway]

Filter the desired events in the base search or a where clause.

baseSearch version=beta 
| stats dc(version) as found_in_versions BY name, platform 
| where found_in_versions < 2

baseSearch 
| where version=beta
| stats dc(version) as found_in_versions BY name, platform 
| where found_in_versions < 2