When multivalue field is given as field-list for transaction, transaction does not attempt to combine the events despite the events have common multivalue field. Example Query: | makeresults count=4
| streamstats count
| eval abc="123"
| eval def=if(count!=2, "456", null())
| eval ghi=if(count!=1, "789", null())
| eval abc=mvdedup(mvappend(abc, def, ghi))
| transaction abc keeporphans=1 keepevicted=1 I'd expect all 4 events to be combined to 1 as all events have common value of "123". However this is not the case. Is there any way to make this happen?
... View more