Hello,
I need some assistance on the following scenario.
Let's say I have a fields "Country" "cities" "command"
These are few events:
These are few cities of India.
Country=India, cities="Hyderabad, Bangalore, Kerala" command="common"
Country=Srilanka cities="Kandy, Colombo, Galle"
Country=Australia cities="Melbourne, sydney, Adelaide" command="common"
Country=USA cities="California, Cupertino, NewJersey"
Country=UK cities="Manchester, Headingley, Edgbaston" command="common"
Country=china cities="Beijing, Shanghai, Tianhe, common"
I have a sample query which gives me the result of source
index=sai_core sourcetype="city_log" command="common"
| makemv delim="," cities
| stats values(cities) as cities by source
I want to make use of these results of source to use as a group by for another search.
index=sai_core sourcetype="city_log"
| makemv delim="," cities
| stats values(cities) as cities by source
How do I do this?
... View more