How do i extract certain fields and data from _raw and display in table form@ eg
_raw
[{"Conutry":"America","State":"Nevada","Population":"6564654"},{"Conutry":"America","State":"California","Population":"42475"}]
many thanks
@NayneshPatel
Try this.
YOUR_SEARCH | spath | rename {}.* as * | eval tmp=mvzip(mvzip(Conutry,State),Population) | mvexpand tmp | eval Conutry=mvindex(split(tmp,","),0),State=mvindex(split(tmp,","),1),Population=mvindex(split(tmp,","),2) | table Conutry, State ,Population
Sample:
| makeresults | eval _raw="[{\"Conutry\":\"America\",\"State\":\"Nevada\",\"Population\":\"6564654\"},{\"Conutry\":\"America\",\"State\":\"California\",\"Population\":\"42475\"}]"| spath | rename {}.* as * | eval tmp=mvzip(mvzip(Conutry,State),Population) | mvexpand tmp | eval Conutry=mvindex(split(tmp,","),0),State=mvindex(split(tmp,","),1),Population=mvindex(split(tmp,","),2) | table Conutry, State ,Population
@NayneshPatel
Try this.
YOUR_SEARCH | spath | rename {}.* as * | eval tmp=mvzip(mvzip(Conutry,State),Population) | mvexpand tmp | eval Conutry=mvindex(split(tmp,","),0),State=mvindex(split(tmp,","),1),Population=mvindex(split(tmp,","),2) | table Conutry, State ,Population
Sample:
| makeresults | eval _raw="[{\"Conutry\":\"America\",\"State\":\"Nevada\",\"Population\":\"6564654\"},{\"Conutry\":\"America\",\"State\":\"California\",\"Population\":\"42475\"}]"| spath | rename {}.* as * | eval tmp=mvzip(mvzip(Conutry,State),Population) | mvexpand tmp | eval Conutry=mvindex(split(tmp,","),0),State=mvindex(split(tmp,","),1),Population=mvindex(split(tmp,","),2) | table Conutry, State ,Population
Perfect thanks you
Not sure if you can further help me,
From the Field Population, can you filter out the results so if it contains anything other then "6564654" and "42475", then show the results. along with county and state
@NayneshPatel
For excluding events having Population
value 6564654
& 42475
, just append below search with existing.
| search NOT (Population IN (6564654,42475))
Brilliant, thanks Kamlesh