I have transactional data, meaning each entry contains a transaction_id. I want to group by transaction_id and create some aggregates, like count unique values of some attributes. Then I want to filter the data using those aggregates, and only transactions which contain single values on those aggregated attributes should remain in the result.
Similar lile in SQL with GROUP by and HAVING clauses.

Currently, I tried with:

index=some_index | transaction attrTransId | eventstats dc(aggrAttr1) as nAggrAttr1 dc(aggrAttr2) as nAggrAttr2 by attrTransId | where nAggrAttr1 == 1 AND nAggrAttr2 == 1 | table attrTransId | join type=inner attrTransId [search index=some_index]

But no result is generated, even though lots of events exist which match the criteria.