I have search querrie created from json file. Problem is values that i have appear in one row, instead of 3 rows(in json file we have three ids with number and status). Thanks in advance!!
alt text
Hi
Try this
| makeresults
| eval id="02,03,01"
| makemv delim="," id
| appendcols
[| makeresults
| eval Number="30,20,40"
| makemv delim="," Number]
| appendcols
[| makeresults
| eval Status="In progress,In Progress,To Do"
| makemv delim="," Status]
| fields - _time
| eval temp=mvzip(mvzip(id,Number),Status)
| fields temp
| mvexpand temp
| eval temp_value=split(temp,",")
| eval id=mvindex(temp_value,0), Number=mvindex(temp_value,1), Status=mvindex(temp_value,2)
| table id Number Status
Hi
Try this
| makeresults
| eval id="02,03,01"
| makemv delim="," id
| appendcols
[| makeresults
| eval Number="30,20,40"
| makemv delim="," Number]
| appendcols
[| makeresults
| eval Status="In progress,In Progress,To Do"
| makemv delim="," Status]
| fields - _time
| eval temp=mvzip(mvzip(id,Number),Status)
| fields temp
| mvexpand temp
| eval temp_value=split(temp,",")
| eval id=mvindex(temp_value,0), Number=mvindex(temp_value,1), Status=mvindex(temp_value,2)
| table id Number Status
Thanks. This looks great! But it should be done without given values.
Hi
Try this
source="jsonfile"
| rename customfield_1 AS id, customfield_2 AS Status, customfield_3 AS Number
| eval data=mvzip(mvzip(id,Number),Status)
| mvexpand data
| makemv data delim=","
| eval id=mvindex(data,0),Number=mvindex(data,1), Status=mvindex(data,2)
| fields - data
This is great!!They are separated now with their values. Is it possible to make a table only from those three: id, number and label. because a result returns also other fields. could you help me with that?
You can use table
command with the required column at the end
Great! Thank You very much!
Please accept the answer.
use mvzip
to three fields. and mvexpand
and re-extract them.
Can you show me on example querry
what's your query?
yes.
source="jsonfile" |rename customfield_1 AS id, customfield_2 AS Status, customfield_3 AS Number | eval data=mvzip(id,Number,Status)| mvexpand data| makemv data delim=","| eval id=mvindex(data,0),Number=mvindex(data,1), Status=mvindex(data,2)| fields - data