| makeresults
| eval _raw="State,Date,Desc,Count
bc,11102021,vm,234569
bc,12102021,vm,456328
bc,11102021,vm,234569
bc,12102021,vm,4532178
cd,11102021,vm,234000
cd,12102021,vm,234000
cd,11102021,vm,234000
cd,12102021,vm,568902"
| multikv forceheader=1
| table State,Date,Desc,Count
| streamstats count as row by State
| eval row=if(row=4,mvappend(row,"0"),row)
| mvexpand row
| sort 0 State -row
| streamstats values(Count) as next current=f window=1 by State
| where row>0 AND Count=next
| sort 0 State row
... View more