And I will give you another approach. | makeresults format=csv data="field1,field2,field3,field4,fiel5,field6,field7,field8,field9,field10,field11 sys1,2,a,v,4,65,2,dd,2,f,44 sys2,2,b,v,4,55,2,dd,...
See more...
And I will give you another approach. | makeresults format=csv data="field1,field2,field3,field4,fiel5,field6,field7,field8,field9,field10,field11 sys1,2,a,v,4,65,2,dd,2,f,44 sys2,2,b,v,4,55,2,dd,2,f,44" | appendpipe [ | stats dc(*) as * | eval field1="count"] | transpose 0 header_field=field1 Now you can decide whether to include only those rows where you have one or two different values. You can play with this to account for more rows and such. And I'm assuming your sys1,sys2 names can be dynamic. Otherwise your solution would be as simple as | where sys1=sys2 (or NOT)