Group repeating values of a field

[jedatt01]

I have a csv data source with example values as follows

MAC_ID, SSID
AAAA.AAAA.AAAA, TEST
BBBB.BBBB.BBBB, TEST
CCCC.CCCC.CCCC, TEST2
AAAA.AAAA.AAAA, TEST2
BBBB.BBBB.BBBB, TEST3

I want to be able to display a table that shows repeating values of MAC_ID like below
AAAA.AAAA.AAAA, TEST, TEST2
BBBB.BBBB.BBBB, TEST, TEST3

please help!

[lukejadamec · Accepted solution]

I don't think you can do that on a large scale. If the MAC_IDs and SSID's were known, then you could create a look up table matrix.

What you're asking for is changing the SSID field into a new field based on the SSID.

This would be easy with a table, but it would be vertical, not horizontal:

search | table MAC_ID,SSID | sort -MAC_ID

[adityapavan18 · Accepted solution]

Try something like this

|inputlookup something.csv | stats count values(SSID) by MACID | where count > 1

This will show you the MAC ID having repetitive values.

[jedatt01]

Thanks, this got me far enough that it worked

[sowings]

Note that values() normalizes the list, and sorts them, while list() would give you each and every occurrence, in the order in which it appears in the log. In this case, values is probably what you want, but list can have its utility, too.

[lukejadamec · Accepted solution]

I don't think you can do that on a large scale. If the MAC_IDs and SSID's were known, then you could create a look up table matrix.

What you're asking for is changing the SSID field into a new field based on the SSID.

This would be easy with a table, but it would be vertical, not horizontal:

search | table MAC_ID,SSID | sort -MAC_ID

[jedatt01]

Same with this one, worked for me as well