index=app sourcetype=epcpromotionsevent | stats count as num by eventName,hotelId
above query will display count, eventName, hotelId three properties.
I want to solve below issue:
1.when count is 1,and more than 2 row data record, then display.
2.when count is more than 1, display.
3.others, no display.
↧