How to separate multiple results in one line ?

[mah]

Hi,

I have a table like this : 3 column minimum :

The problem is that I want a table which is showing results in separate lines like : 

name	targetUrl	time
loading...	htthps://...	942
/servicedesk/.../user/...	htthps://...	5194
/servicedesk/customer/...	htthps://...	1447

I tried a stats commands like : 

|stats count by name targetUrl Time 

but the result gave me that : 

name	targetUrl	time
loading...	htthps://...	1447
/servicedesk/.../user/...	htthps://...	1447
/servicedesk/customer/...	htthps://...	1447

Can you help me please ?

[ITWhisperer]

It might be easier to not have multi-values in the first place. Can you show more of your query for your original table to show how the multi-value fields are being generated?

[mah]

The query is very simple : 

Index=A sourcetype=B Type=C | table name targetUrl Time

for the example of a log, I filtered on one user that did 3 actions :

{ 

actions: [ [-] 
     {  [-] 

targetUrl:  https...    

Time: 942

name : loading 
     }

     {  [-] 

targetUrl: https://.. .     

Time: 5194

name : /servicedesk/...
     }

 {  [-] 

targetUrl: https...    

Time: 1447

name : /servicedesk/customer
     }   ]

}

The actions are in a list [] in the json and I think that is causing the issue to group in one line, no ?

[ITWhisperer · Accepted solution]

Did you use spath to split the json or was it done when the event was indexed?

The issue can be resolved by splitting the parsing of the json into two parts. First to get the actions list, then to split each action. By putting a mvexpand between the two you can separate each action into a different line

| makeresults | eval _raw="{
\"actions\" : [{
\"targetUrl\":\"https://..\",
\"Time\":942,
\"name\":\"loading\"},
{
\"targetUrl\":\"https://..\",
\"Time\":5194,
\"name\":\"/servicedesk/\"},
{
\"targetUrl\":\"https://..\",
\"Time\":1447,
\"name\":\"/servicedesk/customer\"}]
}"
| spath path=actions{} output=actions
| fields - _raw
| mvexpand actions
| spath input=actions
| fields - actions

[mah]

That exactly what I was looking for. 

Works perfectly ! 

Thank you very much !