Again - it might be expected but is it the correct result? Consider this example run-anywhere search | makeresults format=csv data="a,b,c 2,3,3 1,2,3 2,2,2 1,3,2" | dedup c | stats count by a...
See more...
Again - it might be expected but is it the correct result? Consider this example run-anywhere search | makeresults format=csv data="a,b,c 2,3,3 1,2,3 2,2,2 1,3,2" | dedup c | stats count by a b c Run it, write down the results. Now run the same search but with a reordered input mockup data | makeresults format=csv data="a,b,c 1,2,3 2,3,3 1,3,2 2,2,2" | dedup c | stats count by a b c As you can see, the data on which you're operating is the same, just in a different order and the results are completely different. So you might want to rethink your search logic.