How to split values that appear in one row?

[ikoniasavina]

I have search querrie created from json file. Problem is values that i have appear in one row, instead of 3 rows(in json file we have three ids with number and status). Thanks in advance!!
alt text

[vnravikumar · Accepted solution]

Hi

Try this

| makeresults 
| eval id="02,03,01" 
| makemv delim="," id 
| appendcols 
    [| makeresults 
    | eval Number="30,20,40" 
    | makemv delim="," Number] 
| appendcols 
    [| makeresults 
    | eval Status="In progress,In Progress,To Do" 
    | makemv delim="," Status] 
| fields - _time 
| eval temp=mvzip(mvzip(id,Number),Status) 
| fields temp 
| mvexpand temp 
| eval temp_value=split(temp,",") 
| eval id=mvindex(temp_value,0), Number=mvindex(temp_value,1), Status=mvindex(temp_value,2) 
| table id Number Status

[ikoniasavina]

Thanks. This looks great! But it should be done without given values.

[vnravikumar]

Hi

Try this

source="jsonfile" 
| rename customfield_1 AS id, customfield_2 AS Status, customfield_3 AS Number 
| eval data=mvzip(mvzip(id,Number),Status) 
| mvexpand data 
| makemv data delim="," 
| eval id=mvindex(data,0),Number=mvindex(data,1), Status=mvindex(data,2) 
| fields - data

[ikoniasavina]

This is great!!They are separated now with their values. Is it possible to make a table only from those three: id, number and label. because a result returns also other fields. could you help me with that?

[vnravikumar]

You can use table command with the required column at the end

[ikoniasavina]

Great! Thank You very much!

[vnravikumar]

Please accept the answer.

[to4kawa]

use mvzip to three fields. and mvexpand and re-extract them.

[ikoniasavina]

Can you show me on example querry

[to4kawa]

what's your query?

[ikoniasavina]

yes.
source="jsonfile" |rename customfield_1 AS id, customfield_2 AS Status, customfield_3 AS Number | eval data=mvzip(id,Number,Status)| mvexpand data| makemv data delim=","| eval id=mvindex(data,0),Number=mvindex(data,1), Status=mvindex(data,2)| fields - data