Thanks everyone for the help. Question I would like to group the multiple DSLAM_NODE_NAMES together instead of having to searching for them in the table. So maybe like the highest hit be at the top. Any thoughts? Below is what I have that is working for the first part.
index=iptv_hist sourcetype=rx_session_v2
| append [search index=poll_dslam sourcetype=poll_dslam_inventory
| fields CKTID_OR_TN, DSLAM_NODE_NAME, CODE4]
| stats last(DSLAM_NODE_NAME) as DSLAM_NODE_NAME, last(CODE4) as CODE4 by CKTID_OR_TN
| table CKTID_OR_TN, DSLAM_NODE_NAME, CODE4
| dedup CODE4, DSLAM_NODE_NAME
| rename CODE4 as "Closing Codes", CKTID_OR_TN as "BTN", DSLAM_NODE_NAME as "DSLAM CLLI"
... View more