Updated with information from the comment thread. The correct way to do this for an mv field these days...
| eval Field3=mvappend(Field1,Field2) | eval Field3=mvdedup(Field2) |
or just
| eval Field3=mvdedup(mvappend(Field1,Field2))
What I suggest:
.... | eval Field3=coalesce(Field1,Field2) | dedup Field3 | ...
I'm wondering if the problem is still in place, I found this thread because I had this issue :).
... View more