Could someone please show the difference between nomv and mvcombine with some examples? What I have seen is that both work exactly the same way and delim parameter in mvcombine doesn't work as e...
...y workaround for that is that I am using mvcombine over the LINE column, which assembles all rows together into one, works fine.
The only problem I have is, that the emtpty rows (well, they c...
My apologies for the duplicated question - I wasn't sure whether I could tag my particular situation re- mvcombine not using the delimiter when specified.
The search I'm using is
* | stats l...
Hi,
I'm trying to convert a dashboard based on internal searches to one using data models. One thing I'm missing is that in the internal search I can present the values on a single line by using mvcombine...
So, I know MV Combine asks that you specify the one unique field in a set of results, and returns a multi-value entry that merges all the non-unique values. I want to do the opposite.
I have a tab...
...am_unix(sshd:session): session opened" | stats values(user) as "user" by host | mvcombine delim="," user
This works great, but for some reason the results are not honoring the delim="," and so they're c...
...own here. It correctly expands out my first field but it at the same time flattens my other multivalued value. (For the record mvcombine has the same problem)
Here's a simple but completely a...
I have a list of 5 elements:
After i use mvcombine i return only 1 result, but i have effectively 5 elements.
The $job.resultCount$ return 1, how to return 5?
Hi folks,
I'm trying to merge events that share a common keyword value, with the mvcombine. The problem is it just lists the same value multiple times; I want it to add them up.
The search is r...
...msName | mvcombine emsName
Before applying the mvcombine, the time stamp shows correctly.
Example
BEFORE:
_time emsName
19/08/2010 09:00 tcp://ems-dit-eu-uat-1: Tier 2
19/08/2010 09:0...