What would be the right approach to rerurn results when a unique field value is seen with several if another field value?

[dannyze]

For example

  index=active_directory |  eventstats count by useraccount | search count=1

The above returning events for a unique field value of useraccount. What I am looking for is events with a unique user account grouped with several of another field value. Have tried transaction command to no avail.

Pointing in the right direction is greatly appreciated.

[xavierashe]

index=active_directory | stats values(process_name) count by user

[to4kawa]

grouped with several of another field value.
What's the fields?

[dannyze]

Field of process_name
So one useraccount with many processes accessed , process_name being many different values

[xavierashe]

Is this closer to what you are looking for?

index=active_directory | stats values(process_name) by user

[dannyze]

Yes this works!
I just added a count

| stats count values(process_name) by user

[xavierashe]

Great, I'll post it as an answer so you can accept it.

[dannyze]

After testing it out, it is returning on a single process_name value given the threshold.
So instead of returning results where one user is seen with many process_name values it groups a user with any process_name value

Hopefully this came across clearly
Thank you

[xavierashe]

something like this?

index=active_directory | stats distinct_count(user) as distinct_count by host | where distinct_count=1