Hello All,
i need a help in creating report
i have a mv field called "report", i want to search for values so they return me the result.
i tried with "IN function" , but it is returning me any values inside the function.
to be particular i need those values in mv field
for example, i have two fields manager and report, report having mv fields
manger------------------------ report
john ------------------ day1
------------------ day2
------------------ day3
------------------ day4
kevin -------------- day1
------------------ day4
index="my search" | where in(report,"day1","day4")
so here i'm expecting only results for kevin
i dont want to mv index it into multiple fields!
... View more