So, I know MV Combine asks that you specify the one unique field in a set of results, and returns a multi-value entry that merges all the non-unique values. I want to do the opposite.
I have a table of events that contains a single non-unique field, and I want to merge the unique fields into a single event. For example, the original table might look something like this:
And I'm trying to turn it into something like this:
Does anyone have any insight into how I could do that?
Try this:
...|stats values(*) as * by Hostname
It will give all unique values by Hostname
Try this:
...|stats values(*) as * by Hostname
It will give all unique values by Hostname