I have 2 multivalue collumns like below,giving two rows for example:
Collumn 1 collumn 2
A A
B C
C
A A
B B
A
C
C
i want a third column like this(having values of collumn1 which are in collumn 2)
Collumn 1 collumn 2 collumn 3
A A A
B C C
C
A A A
B B B
A A
C
C
Please note,Collumn 1 can be empty also.
Thanks in Advance.
| makeresults
| eval Col1=split("ABC",""),Col2=split("AC","")
| appendpipe [eval Col1=split("ABACC",""), Col2=split("AB","")]
| streamstats count as session
| mvexpand Col1
| eval result=if(match(Col2,Col1),Col1,NULL)
| stats list(Col1) as Col1 values(Col2) as Col2 list(result) as result by session
| fields - session
I am trying not to use mvexapnd in splunk8
Also I cannot use "makeresult" command since it has to be the first command in my search,which in my case is not.
I don't know what your query is.
It's a query that everyone can do.
Query is what I have asked for and the sample values I have provided.
If you can understand well and good ,else Thanks for your time.