Hi I'm trying to count the number of times of a specific values "not match" exist in a multi-value field, search for events where this value appears more then once.
add an example
| name | Check | ID |
aaa-1 | not match match match | 6564 |
| ddd-1 eee-2 fff-3 | not match match not match | 7875 |
because in the lower row the value "not match" exist more then 1 time (>1).
I don't found a suitable command.
would appreciate help:)
| chart values(name) as name count by ID Check
| where 'count: not match' > 1
| rename "name: not match" as name, "count: not match" as count
| table ID name count
Thank you for your fast response!
I've tried your solution and had a problem in the where part.