Hello Comminity,
Here goes the more detailed descrition
2019-07-12 11:19:55.519 [VDI111][Process1][Info] msg=report;rpt_comment=Installation;rpt_Case_Id=6547456
2019-07-12 11:19:55.519 [VDI111][Process1][Info] msg=report;rpt_comment=Deinstallation;rpt_Case_Id=6547456
I want to create one row i a table where I have:
6547456 | Installation | Deinstallation
I tried search like:
VDI="VDI1" Process="Process1" rpt_comment* | table _time, rpt_Case_Id, rpt_comment
But it does split the rows for the ID
Hope you can come up with some idea.
Cheers,
W
This search will create a single row for each ID, but you will have multiple values in each cell.
VDI="VDI1" Process="Process1" rpt_comment*
| stats values(_time) as _time, values(rpt_comment) as rpt_comment by rpt_Case_Id
| table _time, rpt_Case_Id, rpt_comment