thanks @renjith.nair for your response, although it wasn't exactly what I needed, you pointed me in the right direction! on my end, somehow found=mvfind(vals,"yes") did not evaluate to 1 for some reason. In the end, with trial and error, I went with eventstats values(Col_C) as vals by Col_C | eval found=mvfind(vals,"yes") which actually evaluates to 0 for those with "yes" and a null empty field for those that are not "yes".
All in all, eventstats values(Col_C) as vals by Col_C | eval found=mvfind(vals,"yes") | where found=0 works for me.
If you do not mind, can you explain what does the by Col_A do?
... View more