How to attain a list with all the fields in which a certain string appears?

[msolgonza]

For example, given the fields and values:

field1=A123
field2=baba
field3=A123B
field4=bA123

I want a list with the fields which contain the string "A123":

field1
field3
field4

[aguthrie1190]

| makeresults count=4 | streamstats count | eval field1=if(count<3,"A",0) | eval field2=if(count>3,"A",0) | eval field3=if(count==3,"A",0) | eval field4=0
| eval field_list=""
| foreach * [eval  field_list=if(match(<<FIELD>>,"A"),field_list+" "+"<<FIELD>>",field_list)]
| makemv delim=" " field_list
| mvexpand field_list
| dedup field_list
| fields field_list

Make results just makes some data to work with. Then we make an empty field list, that we will append field names to if they match your string. So match(<<FIELD>>,"A") will evaluate as true when the CONTENT of the field matches "A". Then field_list+" "+"<<FIELD>> will append the NAME of the field to field_list. Otherwise the if statement just returns the previous field_list.

After that line it's just some data manipulation. | makemv delim=" " field_list will turn all your space delimited field_list variables into multivalues, mvexpand expands them all to their own event, then dedup gets rid of the duplicates.

Hope that helps!

[koshyk]

depends on if those fields are present in a single event or in multiple events.
Please put the actual event details

[msolgonza]

The fields can be present in multiple events. Eg of events in a csv lookup format, if I wanted to match "A":

field1, field2, field3, field4
A, 0, 0, 0
0, A, 0, 0
0, 0, A, 0
A, A, 0, 0
0, A, A, 0
A, 0, A, 0
A, A, A, 0

Basically, it can be given in any order

[koshyk]

ah.ok. So the data above is in csv format? Is the columns limited like field1, 2 , 3 ,4 or is it random?