There is this CSV:
user, application, string
user1, app1, "abcd"
user2, app2, "222defg"
user1, app2, "defg"
user1, app1, "123ks"
user2, app3, "111abcd"
I would like the result to look like that:
user1, app1, "abcd"
app2, "defg"
app1, "123ks"
user2, app3, "111abcd"
app2, "222defg"
I tried this query (and switched to stats list, also):
... | table user app string | stats values(app) as app, values(string) as string by user
But it does not keep the formation of the rows. values and list returns a collection of object with no connection to their original event.
An extra question - is there a way to mark the user field (bold/show it as header of a group of events, anything else?)
Thanks!
... View more