Below column has two values after eventstats command. i want to ignore the second events "Passed" from the column "Value". i tried Mvexpand to spilt but i totally dont want since i cant use dedup to remove duplicates
You can use mvindex to replace itself with the first value
| eval Value=MVINDEX(Value, 0)
View solution in original post