I have data of the kind
Name Parameter1 Parameter2 Parameter3
A 1
A 2 3
B 3
B 2
I want to get the result as shown below
Name Parameter1 Parameter2 Parameter3
A 1 2 3
B 2 3
Thanks
@alex_orl,
Try
your search | stats values(*) as * by Name
@alex_orl,
Try
your search | stats values(*) as * by Name
Looking at the top code, will there ever be the case where row 2 and row 3 will both have Parameter1?
You can try something like:
(your search)
| stats list(Parameter1) AS Parameter1 list(Parameter2) AS Parameter2 list(Parameter3) AS Parameter3 BY Name
@alex_orl
Try this
YOUR_SEARCH | stats values(Parameter1) as Parameter1 values(Parameter2) as Parameter2 values(Parameter3) as Parameter3 by Name
Example:
| makeresults | eval _raw=" Name Parameter1 Parameter2 Parameter3
A 1
A 2 3
B 3
B 2
"| multikv | stats values(Parameter1) as Parameter1 values(Parameter2) as Parameter2 values(Parameter3) as Parameter3 by Name
Thanks
Thanks! I was looking for this too and it helps. I find that I only need to use the line below without needing | makeresults. Could you explain more about | makeresults?
| multikv | stats values(Parameter1) as Parameter1 values(Parameter2) as Parameter2 values(Parameter3) as Parameter3 by Name
Thank you.
This totally worked for me thanks a ton! For anyone new to this, the fields will look like they've each been merged into a single value in each Parameter, but are still separate values in a way - they're Multivalues now - so to merge 2 multivalues into one, use mkjoin or mkindex(field,0)+mkindex(field,1)