I need to combine 3 fields as single field
eg:
Field1 Field2 Field3
3 6 xyz
4 7 56
5 abc ghj
Field4
3
4
5
6
7
abc
xyz
56
ghj
Like this:
... | eval mega = mvappend(mvappend(Field1, Field2), Field3)
With possibly this after that:
| stats values(mega) AS mega
Try this!
(your search)
| eval Field4=Field1.",".Field2.",".Field3
| fields - Field1,Field2,Field3
| makemv delim="," Field4
| mvexpand Field4
Thanks for the answer, how can we remove the unwanted values for eg: if the values contain symbol hyphen ( - ) or or NULL