I'm trying to make a table that has one of the column headers to have the value as the most occurring value in another column. I want to do something similar to this:
..| rename columnX as [stats mode(columnY)]
In general you can do things like this:
| stats count | rename count as [stats count | return $count]
Note though, the subsearch does not use any info from the surrounding search, you will have to retrieve that from within the subsearch.
In general you can do things like this:
| stats count | rename count as [stats count | return $count]
Note though, the subsearch does not use any info from the surrounding search, you will have to retrieve that from within the subsearch.