At first this sounded like an easy question. However, after reading it several times I am not so sure about it anymore.
So, let's talk about your example. First of all, I need to understand what exactly you want to archieve, that's not clear to me. Your "field_to_copy" naming kinda confuses me.
So this:
Column names: ID, Team, Department, field_to_copy
Values: 1, Manager, A65, Team
Becomes this:
Column names: ID, Team, Department, field_to_copy
Values: 1, Manager, A65, Manager
Which means simply changing the values of field_to_copy to the values of Team?
Am I correct?
If so:
Your search with lookup first followed by an eval:
search [...] | fields ID, team, Department, field_to_copy | eval field_to_copy=$team$ | table ID, team, Department, field_to_copy as Whatever_its_real_column_name_is
Is that what you are trying to do?
When I'm wrong I'll convert to comment. But maybe you can clear my confusion. 🙂
Skalli
... View more