You could do something like this:
yoursearchhere
| eval compareString = min(X,Y) + max(X,Y)
| dedup compareString
| fields - compareString
I am not entirely sure this will work, but I think it will
You could do something like this:
yoursearchhere
| eval compareString = min(X,Y) + max(X,Y)
| dedup compareString
| fields - compareString
I am not entirely sure this will work, but I think it will
thanks a lot
Those two lines don't look like duplicates to me, so dedup isn't going to throw one out. One would be thrown out if X=A and Y=B is true for both events.