How to write a search to filter and only return results for a field with a count greater than 2?

[rgtsplunk]

It seems that this should be a simple filter, but we cannot seem to find out how to do this in Splunk.

We do a search, returning a UserID and a Source_Address. We would like to show all the source addresses for the given UserID, but only if the number of source addresses for that UserID is greater than 2.

We can use "stats distinct_count(Source_Address) as num_sources BY UserID | search num_sources > 2", but the output of that no longer has the actual Source Addresses for us to show - only the number. The "where" clause does not specify a way of counting by UserID, nor does anything else, it appears.

The only other thing we can see is to do the whole search as a sub-search, just returning the UserIDs, and then using that as a filter for the search again. This seems very inefficient. Can anyone suggest a better method?

[somesoni2]

Try this

...your base search...|  stats count by UserID Source_Address | eventstats count as num_sources  by UserID | search num_sources > 2 | table UserID Source_Address

[vasanthmss]

Try this,
|eventstats dc(sourceaddress) as count by userid|search count >2