My data looks like the following  student_id browser_id guid datetime x_id 12_a Chrome_2 1122 1/9/23 14:45 788a 13_a Chrome_4 1213 1/12/23 19:13 33b 14_a Chrome_3 1422 1/13/23 1:42 24c 15_b FireFox_1 1289 1/16/23 15:46  12d 12_a Chrome_2 1132 1/11/23 21:50 788a Ideally, we shouldn't have different guids given same student_id, browser_id and x_id. I am trying to find all those student_ids who violate this rule aka student_ids with same browser_id and x_id but different guid. So for the above, I'd like to see something like -        12_a Chrome_2 1122 1/9/23 14:45 788a 12_a Chrome_2 1132 1/11/23 21:50 788a       I am trying -        index="main_idx" app="student_svc" | stats count by student_id browser_id guid datetime x_id | where count > 1 | stats list(count) by student_id       But it doesn't seem to be yielding the result. What should be the fix? Thanks ... View more