values into multiple field

[yuming1127]

Hi,

cannot found anything similar to this issue, please guide me or forward any related thread to me. Thanks

my search......
| table product, product_tag sortby product,product_tag

Current output:

product	product_tag
product1	A_tag1
product1	A_tag2
product1	B_tag1
product2	C_tag1
product3	D_tag1
product3	D_tag2

Desired Output:

product	product_tag1	product_tag2	product_tag3
product1	A_tag1	A_tag2	B_tag1
product2	C_tag1	NA	NA
product3	D_tag1	D_tag2	NA

Regards,

Yu Ming

[ITWhisperer]

| makeresults 
| eval _raw="product	product_tag
product1 	A_tag1
product1 	A_tag2
product1 	B_tag1
product2	C_tag1
product3	D_tag1
product3	D_tag2"
| multikv forceheader=1
| fields - _* linecount


| streamstats count as row by product
| eval new_tag="product_tag".row
| eval {new_tag}=product_tag
| fields - row product_tag new_tag
| stats values(*) as * by product

[yuming1127]

hi,  for 

......

| eval _raw="product product_tag
product1 A_tag1
product1 A_tag2
product1 B_tag1
product2 C_tag1
product3 D_tag1
product3 D_tag2"

......

actually my data contain of thousands of product & product tag, what should i replace this with? my table command?

[ITWhisperer]

This is a run-anywhere example to demonstrate what you could do.

The bit above the blank lines just creates some dummy data based on the example you posted, replace these lines with your search and modify the field names in the lower part so they match the fields your search is returning.

If you want to see how it is working, remove the lower part to see the dummy data, then add the lower part to see the solution in action.

[yuming1127]

Get it,
thanks for the quick reply and  great solution, really appreciate it.