Hi @shawngsharp Further to my last post, you could also use: |foreach * [eval field_matches = mvappend(field_matches, if(match(<<FIELD>>, "(?i)widget"), "<<FIELD>>", null()))]
| eval field_matches...
See more...
Hi @shawngsharp Further to my last post, you could also use: |foreach * [eval field_matches = mvappend(field_matches, if(match(<<FIELD>>, "(?i)widget"), "<<FIELD>>", null()))]
| eval field_matches=mvfilter(NOT match(field_matches,"my_field_42"))
| where field_matches!="" Where your string match is inside the match statement, this works by looking in each field and then creating a multi-value field of all the fields which match, then removing my_field_42 and searching where there is one or more fields that match. |makeresults format=csv data="my_field1, my_field_2, my_field_23, my_field_42
\"hello world\",\"AwesomeWidget69\",\"\",\"your mom\"
\"hello world\",\"\",\"Widgets are cool\",\"Look, a widget!\"
\"hello world\",\"\",\"Some value here\",\"your widget\""
|foreach * [eval field_matches = mvappend(field_matches, if(match(<<FIELD>>, "(?i)widget"), "<<FIELD>>", null()))]
| eval field_matches=mvfilter(NOT match(field_matches,"my_field_42"))
| where field_matches!="" Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing