| inputlookup id_test.csv
| reverse
| eval _time=now()| transaction Col_A startswith=(Col_C=yes)
returns results:
![alt text][1]
With table and even fields afterward, there are no results:
![alt text][2]
[1]: /storage/temp/255916-splunk-trans-1.png
[2]: /storage/temp/255917-splunk-trans-2.png
↧