index=jedi domain="jedi.lightside.com" (master!="yoda" AND master!="mace" AND master="Jinn")
| table saber_color, Jname, strengths, mentor, skill, domain, mission
index-=sith broker sithlord!=dar...
See more...
index=jedi domain="jedi.lightside.com" (master!="yoda" AND master!="mace" AND master="Jinn")
| table saber_color, Jname, strengths, mentor, skill, domain, mission
index-=sith broker sithlord!=darth_maul
| table saber_color, Sname, strength, teacher, actions
I need to list where Jname=Sname, but I need to list all columns
The third one is
where the Jname!=Sname
The caveat is I cannot use the join for this query.
This helped however I am unable to utilize the index drill down for each in the search otherwise the query is 75% white noise.
index=jedi OR index=sith
| eval name=coalesce(Jname, Sname)
| stats values(name) as names by saber_color strengths
| where mvcount(names)=1
Please help.