Hi,
I have a could of fields that contain multiple values, and I am trying to seperate them into sepereate records. The following query works 90%. The only issue is that the last field in the subsearch is not displaying the unique valeus, for example it may contain the value: 2,3 but it will only display 2. Every other field works fine in terms of displaying all the unique values per record. This is the current query I have:
index=index sourcetype=csv source=src1 host=host1
| stats count by ITEM field2 field3 field4
| rename field2 as F_2 field3 as F_3 field4 as F_4
| join ITEM
[ search index=index sourcetype=csv source=src2 host=host2
| stats count by SKU c_2 c_3 c_4
| rename SKU as ITEM | rename c_2 as C_2 c_3as C_3 c_4as C_4 ]
| eval DIFF1=F2-C_2
| eval DIFF2=F_3-C_3
| sort limit=0 ITEM
| table ITEM, F_2, F_3, F_4, c_2, c_3, c_4, DIFF1, DIFF2
Can someone suggest what I can do to fix the problem?
Thanks
... View more