Hi , I am having data like
Col1 Col2(created from values())
row 1 X A B C
row 2 Y A B
how to get column with value C as its unique value in col2
Thanks
Not very clear. Do you want seperate row for "C" ?
<your base search>| makemv delim=" " col2|mvexpand col2
Not very clear. Do you want seperate row for "C" ?
<your base search>| makemv delim=" " col2|mvexpand col2
as A B already there in one row in single column , so want difference between two rows which is C
Not sure if this helps. You can use the logic according to your requirements. Hope it helps
<your base search>| makemv delim=" " col2|mvexpand col2 | stats count(col2) as count by col2 | eval new_column=if((count=1),col2,"") | table new_column
to clarify
col1 having X
Col2 having A B C (multivalues)
second row col2 A B