I have 2 field that holds 3 values
Field 1
values= a,b,c
Field 2
values= 1,2,3
Is there a way to table
without using Join/append/appendcols command?
this is how my search query looks so far but im getting this wierd results
index= example sourcetype=example1
|search "example"
|rex field=text "???<field1>"
|rex field=text "OTL<field1>"
...exisiting search query
|appendcols
index= example sourcetype=example1
|search "example"
|rex field=text "???<field1>"
|rex field=text "OTL<field1>"
|search field1 != c
|rex field=text "<field2>"
|table field1 field2
|search field2= 1
|append
[index= example sourcetype=example1
|search "example"
|rex field=text "???<field1>"
|rex field=text "OTL<field1>"
|search field1 != a field1 !=b
|rex field=text "<field2>"
|table field1 field2
|search field2= 2]
the weird results I'm getting is
Ok. You are doing some strange things here. You're going several times over the same data extracting the same fields. You are doing negative matches. You're posting some partial search in pseudo-SPL
Just show us the source events (anonymized if need be) and describe the desired output and relation between events and output without using SPL.