Hi there, I have a bit of a tough one. I have a log with multiple entries of the same field, basically a list of values. I am trying to merge these values into a single new field, with a line for every value that was in the RAW event. An example: 2020-07-21T01:52:37+00:00 devicename=device1 | id=a522131 | date=2020-07-21T01:51:20 | name=peter | score=5 | action=read | randomfield1=nothingimportant | score=2 | action=read | score=2 | action=write | score=2 | action=write | randomfield2=nothingimportant The intended resulting table where "actions" is a mv field, listing all actions (merging "score" and "action" as well), each on a line, but within the single field (actions): name=peter actions= 5:read 2:read 2:write 2:write ... View more

Hi I am looking at data which includes a field with multiple lines of values. For instance: $name$, $products$, $country$ ============================ an example of an event: name: Peter Thompson products: windows 10 office 2017 adobe reader 9 country: Germany ============================ What I am trying to achieve is a table like: name products country Peter Thompson Windows 10 Germany Peter Thompson Office 2017 Germany Peter Thompson Adobe Reader 9 Germany ============================ To do this I am using mvexpand on the products field which gives me the separated products and sorts them by rarity. I cannot however seem to create a table after that which pulls back the other values such as the name and country. It appears that after the mvexpand or the rare functions, all other fields are lost. ============================ My query: index=data sourcetype=stuff | mvexpand products | rare limit=10 products | eventstats count AS total by products, name | table count, name ... View more