Knowledge Management

Selecting all remaining fields as data fields in xyseries

kshashank004
Loves-to-Learn

Hello,

I am trying to use xyseries to transform the table and needed to know a way to select all columns as data field for xyseries command.

For instance: 

I have a table like this:

xAxisyAxisrandomField1randomField2
abcghi132
defghi2242

 

I want the output as follows:

xAxisrandomField1: ghirandomField2:ghi
abc132
def2242

 

I can do this using the following command

 

 

xyseries xAxix, yAxis, randomField1, randomField2

 

 

But the catch is that the field names and number of fields will not be the same for each search. Meaning, in the next search I might have 3 fields (randomField1, randomField2, randomField3).

Is there any way of using xyseries with dynamic field names? Or is there any other command that can be used?

Thanks

Labels (2)
0 Karma

to4kawa
SplunkTrust
SplunkTrust
| makeresults 
| eval _raw="xAxis,yAxis,randomField1,randomField2,randomField3
abc,ghi,1,32,56
def,ghi,22,42,67" 
| multikv forceheader=1 
| table xAxis,yAxis,randomField1,randomField2,randomField3 
| xyseries xAxis,yAxis 
    [| makeresults 
    | eval _raw="xAxis,yAxis,randomField1,randomField2,randomField3
abc,ghi,1,32,56
def,ghi,22,42,67" 
    | multikv forceheader=1 
    | table xAxis,yAxis,randomField1,randomField2,randomField3 
    | untable xAxis randomField count 
    | where randomField!="yAxis" 
    | stats values(randomField) as query 
    | nomv query 
    | return $query ]

xyseries needs double search.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@kshashank004,

Try

"your search"
|foreach * [eval <<FIELD>>:{yAxis}=<<FIELD>>]

Or if don't want actual fields and only want to persist xAxis

"your search"
|eval _xaxis=xAxis
|foreach * [eval <<FIELD>>:{audittrail}=<<FIELD>>]|fields *:*
|rename _xaxis as xAxis

 

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!