That works as a stand alone search.
But returns no data when adding our search.
index=something
| table Cl_Name, Software_Installed, Software_Version
| eval soft_=Software_Installed
| eval ver_=Software_Version
| makemv soft_ delim=", "
| makemv ver_ delim=", "
| eval soft_zip = mvzip(soft_, ver_)
| mvexpand soft_zip
| rex field=soft_zip "(?<soft>.*),(?<ver>.*)"
| table Cl_Name Software_Installed, Software_Version, soft, ver
or since | makeresults must be the first command. the index=something returns over 15,000 CI_Name, but this search returns 0.
If it would work I would expect 2 million rows. So CI_Name X (Software_Installed X Softeware_Version).
| makeresults
[| search index=something]
| table Cl_Name, Software_Installed, Software_Version
| eval soft_=Software_Installed
| eval ver_=Software_Version
| makemv soft_ delim=", "
| makemv ver_ delim=", "
| eval soft_zip = mvzip(soft_, ver_)
| mvexpand soft_zip
| rex field=soft_zip "(?<soft>.*),(?<ver>.*)"
| table Cl_Name Software_Installed, Software_Version, soft, ver
... View more