hello i have a list of events structured with the following fields : guid (uniqueid), property (name of a property ), value ( value link to the property name). i have 4 specific properties that I received separately on different events and the key is the guid to consolidate the information property/value by guid i make a search => search xxx | table guid , property , value i m able to have all the events in a table in this way guid property value 1 start 1 1 end 2 1 duration 1 1 status OK 2 start 1 2 end 3 2 duration 2 2 status KO I try to transpose the result in this way => search xxx | table guid , property , value | transpose 0 header_field="property" tho have a result like this : guid start end duration status 1 1 2 1 OK 2 1 3 2 KO but the result is not good, is there a way to easily search and display in a readable table this kind of structured events? Other need, how to simply display by guid the status and duration ? Thanks for your help regards Laurent
... View more
