Hi folks,
I'll do my best to explain this. I'll use cars as an analogy because it is easier to explain:
In my data source I have a field, let's call it Model. Results would include: Ford, Dodge, Lincoln, Honda, etc.
In another field I have Make. It would contain: Mustang, Focus, Charger, Civic, Accord, TownCar, etc.
Right now I have a simple table that would look like this:
Model Make
Civic Honda
Towncar Lincoln
Accord Honda
Mustang Ford
Focus Ford
Charger Dodge
The query is | stats count by Make Model | table Model Make | sort -Model
Rather than having a one-to-one list that has duplicate Makes, I would like to have a line show the Make in one field and list ALL the models, separated by comma, in on field value. So it would look like this:
Make Models
Honda Accord, Civic
Ford Focus, Mustang
Lincoln Towncar
Dodge Charger
Can anyone help me get started with this query?
Or this
your base search | stats count by Make Model | table Model Make | stats delim="," values(Model) as Model by Make | nomv Model
Or this
your base search | stats count by Make Model | table Model Make | stats delim="," values(Model) as Model by Make | nomv Model
Take a look at this run-anywhere example:
index=_internal | stats values(source) as source by sourcetype | eval source = mvjoin(source, ", ")
That will give you a comma-separated list of source (Model) values by sourcetype (Make).