Hello
I am trying to duplicate the values of status and user for all rows below so that I can use them in my search later. Is there a way to have all rows filled with the status and user automatically ?
Use eventstats
.
... | eventstats first(status) as status, first(user) as user | ...
Use eventstats
.
... | eventstats first(status) as status, first(user) as user | ...