Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

eval condition help on manipulating a field which has multiple field values?

$
0
0
I have an eval condition in my query as follows My_query | eval object=host." (".id.")" | table host object which gives me the null values on the object field as follows host object abc And reason for empty values in object field is that the id field has more than one value. Now, how can display the object field values in case of multiple values for id field?

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>