I have a table as follows:
col_a | col_b| user_id
000-01 | [null] | [null]
[null] | 000-01 | uid01
000-02 | [null] | [null]
[null] | 000-02 | uid02
All I want is to match the values of col_a and col_b and then fetch the value of respective user_ids.
But the problem is, due to having the values in different rows, I cannot match them using join or match.
Any idea, what to do???
Like this:
... | eval combined = case (isnull(col_a), col_b, isnull(col_b), col_a, true(), col_a . "::" . col_b) | makemv delim="::" combined | stats values(*) AS * BY combined
Or perhaps, if I am misunderstanding you, this:
... | eval combined = case (isnull(col_a), col_b, isnull(col_b), col_a, true(), col_a . "::" . col_b) | makemv delim="::" combined | fillnull value="NULL" user_id | stats values(*) AS * BY user_id
Try this
your base search | eval col_a=coalesce(col_a, col_b) | stats last(user_id) as user by col_a