I am confused as to how using transpose can changes anything. The solution should be the same no matter how you obtain the table. The following will pick up rows with equal values: index=idx1 s...
See more...
I am confused as to how using transpose can changes anything. The solution should be the same no matter how you obtain the table. The following will pick up rows with equal values: index=idx1 source="src1"
| table field1 field2 field3 field4 field5 field6 field7 field8 field9 field10
| transpose header_field=field1
| foreach sys*
[eval _row_values = mvappend(_row_values, <<FIELD>>)]
| where mvcount(mvdedup(_row_values)) == 1 Using your sample data, the result is column sys1 sys2 field3 10 10 field4 a a field6 c c field7 20 20 field9 10 10 Here is an emulation for you to play with and compare with real data | makeresults format=csv data="column, sys1, sys2
field2, a, b
field3, 10, 10
field4, a, a
field5, 10, 20
field6, c, c
field7, 20, 20
field8, a, d
field9, 10, 10
field10, 20, 10"
``` the above emulates
index=idx1 source="src1"
| table field1 field2 field3 field4 field5 field6 field7 field8 field9 field10
| transpose header_field=field1
```