Thanks for the response! To explain, here is 1 row of data for 5 searches. Each search returns several rows of data like this. I just listed 1 row of data for each search for simplicity. Actually, to simplify further I could just show two searches. search1: day_of_week', 'color', 'shape', 'distance' : Monday, black, square, 12 search2: day_of_week', 'color', 'shape', 'distance' : Friday, blue, triangle, 22 search3: day_of_week', 'color', 'shape', 'distance' : Tuesday, red, octagon, 22 search4: day_of_week', 'color', 'shape', 'distance' : Saturday, green, triangle, 12 search5: day_of_week', 'color', 'shape', 'distance' : Saturday, green, triangle, 12 I would like to apply the following logic to compare all instances of returned fields: | eval flagIt=If (day_of_week!=day_of_week AND color!=color AND shape=shape AND distance=distance), flagIt, "True") The problem is this logic doesn't work because the condition is always true with 'field=field.' I am coming from a programmer's perspective so this tells me you need to loop, iterate, increment to do these comparisons. This feels like it would be a common case - comparing events by values returned in fields - like day_of_week - and processing that data to determine the presence or absence of conditions based on logic. I suspect this requires | foreach and it isn't clear if I need to rename the fields for the different searches to compare them or not. The documentation for this function appears to be quite hard to follow.
... View more
