Hi @vumanhtai,
let me understand, do you want to have session_IDs where:
- there's a severity value greater than 2,
- there are more than 2 different severity values?
In the first case, try this:
index=mail sourcetype=webmail
| stats values(time) as time maxs(severity) as severity values(email) as email values(status) by session_ID
| where severity>2
In the second case, try this:
index=mail sourcetype=webmail
| stats values(time) as time values(severity) as severity dc(severity) as dc_severity values(email) as email values(status) by session_ID
| where dc_severity>2
Ciao.
Giuseppe
