| makeresults
| eval HRA="AAAA,BBBB,CCCC"
| eval HRA=split(HRA,",")
| mvexpand HRA
|append [| makeresults |search
| eval HRK="DDDD,BBBB,CCCC"
| eval HRK=split(HRK,",")
| mvexpand HRK]
| appendpipe
[ eval tmp=coalesce(HRA,HRK)
| selfjoin tmp]
| streamstats count
| reverse
| dedup HRA
| sort count
| table HRA HRK _time
| fillnull value="yet to be applied"
Hi, @naliniasb
I make the query from your sample. how about this?
... View more