Hi,
I have a table like this : 3 column minimum :
The problem is that I want a table which is showing results in separate lines like :
name | targetUrl | time |
loading... | htthps://... | 942 |
/servicedesk/.../user/... | htthps://... | 5194 |
/servicedesk/customer/... | htthps://... | 1447 |
I tried a stats commands like :
|stats count by name targetUrl Time
but the result gave me that :
name | targetUrl | time |
loading... | htthps://... | 1447 |
/servicedesk/.../user/... | htthps://... | 1447 |
/servicedesk/customer/... | htthps://... | 1447 |
Can you help me please ?
Did you use spath to split the json or was it done when the event was indexed?
The issue can be resolved by splitting the parsing of the json into two parts. First to get the actions list, then to split each action. By putting a mvexpand between the two you can separate each action into a different line
| makeresults | eval _raw="{
\"actions\" : [{
\"targetUrl\":\"https://..\",
\"Time\":942,
\"name\":\"loading\"},
{
\"targetUrl\":\"https://..\",
\"Time\":5194,
\"name\":\"/servicedesk/\"},
{
\"targetUrl\":\"https://..\",
\"Time\":1447,
\"name\":\"/servicedesk/customer\"}]
}"
| spath path=actions{} output=actions
| fields - _raw
| mvexpand actions
| spath input=actions
| fields - actions
It might be easier to not have multi-values in the first place. Can you show more of your query for your original table to show how the multi-value fields are being generated?
The query is very simple :
Index=A sourcetype=B Type=C | table name targetUrl Time
for the example of a log, I filtered on one user that did 3 actions :
{
actions: [ [-]
{ [-]
targetUrl: https...
Time: 942
name : loading
}
{ [-]
targetUrl: https://.. .
Time: 5194
name : /servicedesk/...
}
{ [-]
targetUrl: https...
Time: 1447
name : /servicedesk/customer
} ]
}
The actions are in a list [] in the json and I think that is causing the issue to group in one line, no ?
Did you use spath to split the json or was it done when the event was indexed?
The issue can be resolved by splitting the parsing of the json into two parts. First to get the actions list, then to split each action. By putting a mvexpand between the two you can separate each action into a different line
| makeresults | eval _raw="{
\"actions\" : [{
\"targetUrl\":\"https://..\",
\"Time\":942,
\"name\":\"loading\"},
{
\"targetUrl\":\"https://..\",
\"Time\":5194,
\"name\":\"/servicedesk/\"},
{
\"targetUrl\":\"https://..\",
\"Time\":1447,
\"name\":\"/servicedesk/customer\"}]
}"
| spath path=actions{} output=actions
| fields - _raw
| mvexpand actions
| spath input=actions
| fields - actions
That exactly what I was looking for.
Works perfectly !
Thank you very much !