Hi, I have a relatively simple search, grouping events based on a extracted correlation id like this: | eval id=coalesce(cid, cid2) | | stats values(*) by id However what I need to do now is further filter down events included in each final row - specifically, I have extacted path1 field on some events and path2 field on others, having the same id. If path1 includes path2, I don't want either event in the aggregated rows. Tried (prior to stats) something like: | eventstats values(path1) as AllPath1 by id | where NOT like(AllPath1, "%".path2."%") ..but for some reason path2 disappears... Any pointers?
... View more