Hi all,
I have several events like this:
Field_A // Field_B // Field_C
A // 1 // z
A // 2 // z
B // 3 // y
B // 4 // x
I would like to create two multivalued fields from Field_B and Field_C relative to Field_A, like this:
Field_A // Field_B // Field_C
A // 1::2 // z
B // 3::4 // y::x
I try mvcombine, but it works only when I have Field_A and Field_B (or Field_A and Field_C). I didn't find how to use it with several fields.
Thank you for any help
@MaryvonneMB how about
<yourMainSearch>
| stats values(Field_B) as Field_B values(Field_C) as Field_C by Field_A
@MaryvonneMB how about
<yourMainSearch>
| stats values(Field_B) as Field_B values(Field_C) as Field_C by Field_A
Thank you very much. I didn't though about stats values. I use mvjoin after to add separator I want and it works well 🙂