I want to map multiple value field to one single value field.
Ex:
COL1 | COL2
VAL1 | Val11
Val12
VAL2 | Val21
Val22
Val23
And the output I want is:
COL1 | COL2
VAL1 | Val11,VAL12
VAL1 | Val21,VAL22,VAL23
Can you try this?
<your_search_goes_here>
| eval new_COL2=mvjoin(COL2,",")
| table COL1 new_COL2
---
An upvote would be appreciated and Accept solution if this reply helps!