I was wondering if there is an easy way to create a table that contains every single recognized interesting field instead of doing the usual | table field1, field2... method. To be clear I want to have each row in the table as a separate instance/log and not a summary of counts. In other words, I would like a substitution for | table but to capture every single interesting field that is recognized. Thanks! i am looking for a shortcut that will basically do something like this: field1 . field2 .... field100 log A: string1. string2 . string100 logB: string21 . string22. string200 I know you can do it manually by performing the command | table field1, field2... field100 but typing out every field i want to capture is extremely time consuming so i am wondering if there is a shortcut to do it ... View more

I was wondering if there is an easy way to create a table that contains every single recognized interesting field instead of doing the usual | table field1, field2... method. To be clear I want to have each row in the table as a separate instance/log and not a summary of counts. In other words, I would like a substitution for | table but to capture every single interesting field that is recognized. Thanks! ... View more

I know you can coalesce multiple columns to merge them into one. However, I am currently coalescing around 8 fields, some of which have null values. Because the last field I am including is sparse (only appears in 3% of the logs), I have found that the coalesced field returns as mostly null (matching the last coalesced field). A demonstration of what I'd like to do is below (A_col is first to coalesce then B_col to make C_col and B_col overwrites A_col if the value in B_col is not null). Here is the query format I am using ... | eval name = coalesce(entityName, individualName) | ... A demonstration of what I'd like to do (C is a coalesced field of A and B): A_col . B_col . C_col A Null . A Null . B . B A . B . B ... View more