- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

nabeel652
Builder
07-15-2019
08:51 PM
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

HiroshiSatoh
Champion
07-15-2019
10:52 PM
If the order of field names is acceptable
... | table * |sort [search (your search)|head 1 | table * | stats dc(*) as * | transpose |head 1|rename column as query]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

HiroshiSatoh
Champion
07-15-2019
10:52 PM
If the order of field names is acceptable
... | table * |sort [search (your search)|head 1 | table * | stats dc(*) as * | transpose |head 1|rename column as query]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

nabeel652
Builder
07-15-2019
11:12 PM
Awesome, that worked. Can you please explain this?
| rename column as query
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

HiroshiSatoh
Champion
07-15-2019
11:39 PM
The return value will be the value only. Usually field = value.
special field:query
index=* [inputlookup xxx.csv | fields col_a]
->(col_a=1) OR (col_a=2) OR (col_a=3) ・・・・
index=* [inputlookup xxx.csv | rename col_a as query | fields query]
->(1) OR (2) OR (3) ・・・・
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
jkat54

SplunkTrust
07-15-2019
09:25 PM
Try this
| stats values(*) as * | sort 0 *
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

nabeel652
Builder
07-15-2019
09:47 PM
Nope, this will group everything up in one cell which is not the desired outcome 🙂
