| makeresults count=4 | streamstats count | eval field1=if(count<3,"A",0) | eval field2=if(count>3,"A",0) | eval field3=if(count==3,"A",0) | eval field4=0
| eval field_list=""
| foreach * [eval field_list=if(match(<<FIELD>>,"A"),field_list+" "+"<<FIELD>>",field_list)]
| makemv delim=" " field_list
| mvexpand field_list
| dedup field_list
| fields field_list
Make results just makes some data to work with. Then we make an empty field list, that we will append field names to if they match your string. So match(<<FIELD>>,"A") will evaluate as true when the CONTENT of the field matches "A". Then field_list+" "+"<<FIELD>> will append the NAME of the field to field_list. Otherwise the if statement just returns the previous field_list.
After that line it's just some data manipulation. | makemv delim=" " field_list will turn all your space delimited field_list variables into multivalues, mvexpand expands them all to their own event, then dedup gets rid of the duplicates.
Hope that helps!
... View more