Repeating fields

[klaudiac]

Hi guys, 

I'm looking to add a new column to my inputlookup. 

The idea is to mark the values that repeat e.g.: 

Email Threat Attachment Delivered	Analytics
Voice mail spam	Network
Jira Heartbeat	N/A
Voice mail spam	Network

And do something like this: 

Name	Zone	Repeats
Email Threat Attachment Delivered	Analytics	No
Voice mail spam	Network	Yes
Jira Heartbeat	N/A	No
Voice mail spam	Network	Yes

I know I can just do a | stats count by Name, but that doesn't solve my problem.

Any hints on how to solve it would be greatly appreciated 🙂 

[richgalloway]

Why does stats not solve your problem?  Have you tried eventstats?

| makeresults | eval _raw="Name                                Zone
Email Threat Attachment Delivered   Analytics
Voice mail spam	                    Network
Jira Heartbeat	                    N/A
Voice mail spam	                    Network" | multikv forceheader=1
```Above just sets up test data```
| eventstats count as Repeats by Name,Zone
| eval Repeats=if(Repeats=1,"No", "Yes")
| table Name Zone Repeats