Selecting all remaining fields as data fields in xyseries

[kshashank004]

Hello,

I am trying to use xyseries to transform the table and needed to know a way to select all columns as data field for xyseries command.

For instance: 

I have a table like this:

xAxis	yAxis	randomField1	randomField2
abc	ghi	1	32
def	ghi	22	42

I want the output as follows:

xAxis	randomField1: ghi	randomField2:ghi
abc	1	32
def	22	42

I can do this using the following command

xyseries xAxix, yAxis, randomField1, randomField2

But the catch is that the field names and number of fields will not be the same for each search. Meaning, in the next search I might have 3 fields (randomField1, randomField2, randomField3).

Is there any way of using xyseries with dynamic field names? Or is there any other command that can be used?

Thanks

[to4kawa]

| makeresults 
| eval _raw="xAxis,yAxis,randomField1,randomField2,randomField3
abc,ghi,1,32,56
def,ghi,22,42,67" 
| multikv forceheader=1 
| table xAxis,yAxis,randomField1,randomField2,randomField3 
| xyseries xAxis,yAxis 
    [| makeresults 
    | eval _raw="xAxis,yAxis,randomField1,randomField2,randomField3
abc,ghi,1,32,56
def,ghi,22,42,67" 
    | multikv forceheader=1 
    | table xAxis,yAxis,randomField1,randomField2,randomField3 
    | untable xAxis randomField count 
    | where randomField!="yAxis" 
    | stats values(randomField) as query 
    | nomv query 
    | return $query ]

xyseries needs double search.

[renjith_nair]

@kshashank004,

Try

"your search"
|foreach * [eval <<FIELD>>:{yAxis}=<<FIELD>>]

Or if don't want actual fields and only want to persist xAxis

"your search"
|eval _xaxis=xAxis
|foreach * [eval <<FIELD>>:{audittrail}=<<FIELD>>]|fields *:*
|rename _xaxis as xAxis