Hello,
I am trying to use xyseries to transform the table and needed to know a way to select all columns as data field for xyseries command.
For instance:
I have a table like this:
xAxis | yAxis | randomField1 | randomField2 |
abc | ghi | 1 | 32 |
def | ghi | 22 | 42 |
I want the output as follows:
xAxis | randomField1: ghi | randomField2:ghi |
abc | 1 | 32 |
def | 22 | 42 |
I can do this using the following command
xyseries xAxix, yAxis, randomField1, randomField2
But the catch is that the field names and number of fields will not be the same for each search. Meaning, in the next search I might have 3 fields (randomField1, randomField2, randomField3).
Is there any way of using xyseries with dynamic field names? Or is there any other command that can be used?
Thanks
| makeresults
| eval _raw="xAxis,yAxis,randomField1,randomField2,randomField3
abc,ghi,1,32,56
def,ghi,22,42,67"
| multikv forceheader=1
| table xAxis,yAxis,randomField1,randomField2,randomField3
| xyseries xAxis,yAxis
[| makeresults
| eval _raw="xAxis,yAxis,randomField1,randomField2,randomField3
abc,ghi,1,32,56
def,ghi,22,42,67"
| multikv forceheader=1
| table xAxis,yAxis,randomField1,randomField2,randomField3
| untable xAxis randomField count
| where randomField!="yAxis"
| stats values(randomField) as query
| nomv query
| return $query ]
xyseries needs double search.
Try
"your search"
|foreach * [eval <<FIELD>>:{yAxis}=<<FIELD>>]
Or if don't want actual fields and only want to persist xAxis
"your search"
|eval _xaxis=xAxis
|foreach * [eval <<FIELD>>:{audittrail}=<<FIELD>>]|fields *:*
|rename _xaxis as xAxis