My base search provides me this result:
Column_1 Column_2
---------------------------
Val1
A Val2
Val3
---------------------------
Val4
B Val5
Val6
Val7
---------------------------
I want to transform value of Column 2 over Column 1.
Output should be:-
A | B
Val1 | Val4
Val2 | Val5
Val3 | Val6
| Val7
I have tried chart values(column_2) by column_1. No luck in that.
| transpose 0 header_field=Column_1
| where column="Column_2"
| fields - column
hi @abhishekpatel2,
Assuming Column_2 is a multivalued field, you can try this query:
base_search | mvexpand Column_2 | eval new=mvzip(Column_1, Column_2) | xyseries new, Column_1, Column_2 | fields - new
If this reply helps you, an upvote/like would be appreciated.
But it is giving only the single values for column_2 I want all the corresponding values of column_2 for that column_1(Duplication of values of column_2 is allowed)
Try this:
base_search | mvexpand Column_2 | streamstats count | eval new=mvzip(Column_1, Column_2, count) | xyseries new, Column_1, Column_2 | fields - new
If this reply helps you, an upvote/like would be appreciated.
It is not giving any output statistics.(What needs to be added after streamstats count or keep as it is?)
The field's name is wrong in line number 7. And remove line numbers 3 and 4, these are not required.
xcjhjcxb j
I get this blank cells under the values for column_1.I need the continuos output or I can say tabular matrix with each cell having values under column_1 no blank cell until no new values found. Can you please help me with this...
Post some input data and output you are expecting.