topic Re: search for multiple value fields to multi column table in Dashboards & Visualizations

search for multiple value fields to multi column table

murat_ekren — Fri, 05 Jun 2020 22:02:18 GMT

title is bit confusing but I have a data like the below

date,assetname,assetIP
2020/05/05 10:00:00,esprbtrapmgr1,195.187.11.144
2020/05/05 10:00:00,nxc-webap2,10.186.36.196
2020/05/05 10:00:00,eytocesxc7p15,10.16.22.186
2020/05/05 10:00:00,eytocesxc7p15,10.16.22.18
2020/05/05 10:00:00,eytocesxc7p15,10.16.26.98
2020/05/05 10:00:00,aktocesxc16p08,10.16.26.21
2020/05/05 10:00:00,aktocesxc16p08,10.16.56.23

and I want a table like
any suggestions ?

assetname| assetIP |assetIP2 |assetIP3    ....
esprbtrapmgr1|195.187.11.144 
eytocesxc7p15 |10.16.22.186|10.16.22.18|10.16.26.98|
aktocesxc16p08|10.16.26.21|10.16.56.23

Re: search for multiple value fields to multi column table

richgalloway — Fri, 22 May 2020 14:08:34 GMT

This brute-force method works, but only with a fixed number of assetIP values.

| makeresults | eval _raw="assetname      assetIP
esprbtrapmgr1  195.187.11.144
nxc-webap2     10.186.36.196
eytocesxc7p15  10.16.22.186
eytocesxc7p15  10.16.22.18
eytocesxc7p15  10.16.26.98
aktocesxc16p08 10.16.26.21
aktocesxc16p08 10.16.56.23" | multikv forceheader=1
`comment("Above just sets test data")`
| stats values(assetIP) as assetIP by assetname
`comment("mvindex(assetIP, 0) must be last")`
| eval assetIP2=mvindex(assetIP, 1), assetIP3=mvindex(assetIP, 2), assetIP=mvindex(assetIP, 0)

Re: search for multiple value fields to multi column table

murat_ekren — Thu, 04 Jun 2020 12:01:06 GMT

Thanks that worked 🙂