list(x) does not return all values. If I have white space as my value, list omits it. Here is a simplified example of my use case:
Desired output:
Address Flag Names
----------------------------
IP1 Jack Jill
IP2 Todd Tammy
IP3 Bill Bill Bob
Partial code snippet:
...
| rex field=Names ".*(?<Flag>Bill).*"
| fillnull value=" " Flag
| stats list(Flag) list(names) by Address
But I'm getting:
Address Flag Names
----------------------------
IP1 Bill Jack Jill
IP2 Todd Tammy
IP3 Bill Bob
I tried using a fillnull value of 0, running the list command, then replacing the 0 with " ", but this still doesn't preserve the order. The value Bill shoots back up to the first line as soon as I replace the zeros.
I'm currently using a table instead, but this adds a lot more rows and is not as easy to read, especially if an IP has many records. I could change fillvalue to a non-whitespace character, but that would look a bit sloppy to the end user, although it is better than resorting to table.
Has anyone else dealt with this? Should I be going at this a completely different way than list?
... View more