There are varying ways, depending on the end goal:
You can list them all horizontally in a separated list
... | stats values(said_field) as said_field | mvcombine delim=" " said_field
You can list them in separate results
... | stats values(said_field) as said_field | mvexpand said_field
...and others.
There are varying ways, depending on the end goal:
You can list them all horizontally in a separated list
... | stats values(said_field) as said_field | mvcombine delim=" " said_field
You can list them in separate results
... | stats values(said_field) as said_field | mvexpand said_field
...and others.
Thank you.