- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Haybuck15
Explorer
03-22-2018
09:51 AM
So, I know MV Combine asks that you specify the one unique field in a set of results, and returns a multi-value entry that merges all the non-unique values. I want to do the opposite.
I have a table of events that contains a single non-unique field, and I want to merge the unique fields into a single event. For example, the original table might look something like this:
And I'm trying to turn it into something like this:
Does anyone have any insight into how I could do that?
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

493669
Super Champion
03-22-2018
09:56 AM
Try this:
...|stats values(*) as * by Hostname
It will give all unique values by Hostname
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

493669
Super Champion
03-22-2018
09:56 AM
Try this:
...|stats values(*) as * by Hostname
It will give all unique values by Hostname
