how to exclucde number of values from search

[Meharkant123]

sourcetype="source_traffic" | stats values(dest_port) by dst_ip

Hi I am lookin for result of IP which have more than one port associate with it.
I would like to exclude the results one IP with one port.
e.g. current result

dest_ip dest_port
10.10.10.01 389
10.10.10.2 162
10.10.10.3 389
............ 143
............ 162
10.10.10.4 389
........... 162
........... 443.

I want result which shows only IP with more than 2 dest_port

dest_ip dest_port
10.10.10.3 389
............ 143
............ 162
10.10.10.4 389
........... 162
........... 443

[Meharkant123]

Yes it is working ..much appreciated. thank you!!!

[somesoni2 · Accepted solution]

Do it like this

sourcetype="source_traffic" 
| stats values(dest_port) as Ports by dst_ip
| where mvcount(Ports)>1