I have an index with multiple fields that I have created using "Extract new fields". The following is the what my current table looks like. I want to merge hostname and version field into one row if the user is the same. I have tried appending, stats(values), joining but not getting the desired result.
index=A | table user, hostname, version
user hostname version
abc pqr EmptyField
abc EmptyField xyz .
Output should be as follow:
user hostname version
abc pqr xyz
@reddevilz ,
If the values are displayed as multi lines, then try
|stats delim="" values(hostname) as hostname,values(version) as version by user
| nomv hostname|nomv version
OR
|stats values(hostname) as hostname,values(version) as version by user
| mvcombine delim="" host|mvcombine delim="" version
@reddevilz ,
If the values are displayed as multi lines, then try
|stats delim="" values(hostname) as hostname,values(version) as version by user
| nomv hostname|nomv version
OR
|stats values(hostname) as hostname,values(version) as version by user
| mvcombine delim="" host|mvcombine delim="" version