I have a csv data source with example values as follows
MAC_ID, SSID
AAAA.AAAA.AAAA, TEST
BBBB.BBBB.BBBB, TEST
CCCC.CCCC.CCCC, TEST2
AAAA.AAAA.AAAA, TEST2
BBBB.BBBB.BBBB, TEST3
I want to be able to display a table that shows repeating values of MAC_ID like below
AAAA.AAAA.AAAA, TEST, TEST2
BBBB.BBBB.BBBB, TEST, TEST3
please help!
I don't think you can do that on a large scale. If the MAC_IDs and SSID's were known, then you could create a look up table matrix.
What you're asking for is changing the SSID field into a new field based on the SSID.
This would be easy with a table, but it would be vertical, not horizontal:
search | table MAC_ID,SSID | sort -MAC_ID
Try something like this
|inputlookup something.csv | stats count values(SSID) by MACID | where count > 1
This will show you the MAC ID having repetitive values.
Try something like this
|inputlookup something.csv | stats count values(SSID) by MACID | where count > 1
This will show you the MAC ID having repetitive values.
Thanks, this got me far enough that it worked
Note that values()
normalizes the list, and sorts them, while list()
would give you each and every occurrence, in the order in which it appears in the log. In this case, values is probably what you want, but list can have its utility, too.
I don't think you can do that on a large scale. If the MAC_IDs and SSID's were known, then you could create a look up table matrix.
What you're asking for is changing the SSID field into a new field based on the SSID.
This would be easy with a table, but it would be vertical, not horizontal:
search | table MAC_ID,SSID | sort -MAC_ID
Same with this one, worked for me as well