I'm looking for a way to dedup a given field for each instance of another field. More specifically: | eval warningIssued=if(transtype="Show Page" AND failed_policy="OS Patches - Download and Install::OS Patches NOT set to Automatic", 1, 0) | eval nowCompliant=if(compliant_policy="OS Patches - Download and Install::OS Patches set to Automatic",1,0) | Following this string, I would like to get rid of everything but the earliest event where warningIssued=1 for EACH MAC address, and the earliest event where nowCompliant=1 for EACH MAC address. Is there any way to dedup this way? ... View more