Hi All,
I have a multi-value field as shown below-
_time | field_test |
2022-05-13 04:36:00 | test_data_1 |
test_data_2 | |
test_data_3 | |
test_data_4 | |
2022-05-13 03:30:00 | test_data_9 |
test_data_10 | |
test_data_3 | |
test_data_4 |
For the above two events, I am trying to write a query which can provide me the common values such that result is-
test_data_3 |
test_data_4 |
Please help me on how can I accomplish it?
@ashishdhinwa - You can try something like
<your query>
| eventstats dc(_time) as total_count
| mvexpand field_test
| stats count, last(total_count) as total_count by field_test
| where field_test>=total_count
| fields field_test
This should provide values that are common for all the _time field values (present in all events).
Hope this helps!!!
| stats count by field_test
| where count > 1
Thanks! This works 🙂