It seems like if you I have a numeric multivalued field, I should be able to use eval to take the max and min of the values per row.
For example, I have a 'bytes' field on my events. i form those events into transactions and now i have a nice multivalued 'bytes' field on my transaction rows.
However when I do this I end up with a multiValued maxBytes, and its exactly as though I had just done:
Is there a reason for why it works this way or is there a workaround for it?
After re-reading the docs, it does seem like this would be a nice feature request. I think you have to use
Perhaps this would be the best fit for your situation:
BTW. Make sure that use include