Combine column values and search

[chiilii]

I have a dynamic table extracted from a search result. Example Table1 that I can get:

Error	Code	Computer
Internet Connection	100	CompA
Blue Screen		CompB
App Crash	5	CompC

My desired result:
For each row in the Table1, I would like to join the columns and make multisearch as below.

index=computer OR index=application (Internet Connection AND 100 AND CompA) | tail 1
index=computer OR index=application (Blue Screen AND CompB) | tail 1
index=computer OR index=application (App Crash AND 5 AND CompC) | tail 1 

I didn't use format in this case because it would end up like..

index=computer OR index=application ( (Internet Connection AND 100 AND CompA) OR (Blue SCreen AND CompB) OR (App Crash AND 5 AND CompC) )

and returns many result instead of only 3 results.

Is the desired result possible to achieve?

[venkatasri]

Hi @chiilii 

You have to extract fields required Error, code and computer for _raw events first and apply | table command should show you  the output required.

How is your original events looks like?

[chiilii]

Hi @venkatasri 

Thanks for looking at this. I am able to get the table but not able to break the table into this:

index=computer OR index=application (Internet Connection AND 100 AND CompA) | tail 1
index=computer OR index=application (Blue Screen AND CompB) | tail 1
index=computer OR index=application (App Crash AND 5 AND CompC) | tail 1

[venkatasri]

what you are trying to achieve?  | tail=1 is not a valid command.

[chiilii]

Sorry have updated the tail and my post too. Hope it is more understandable