I am currently trying to use the Splunk REST API to extract a heap of data.
I have written a search query:
(index=* OR index=_*) (index="myindex") | table "order-no", "order-date", "price"
But it provides a result set which looks like this:
"Order-no", "order-date", "price","quantity"
1 , 20/05/2017 , 1.0, 1
--------------------, 2.0, 1
---------------------,3.0, 2
It rolls 2.0 and 3.0 up to 1 record along side row order-no = 1.
So when i try to export this as a CSV using REST API, the output is all jumbled up.
Is there a way to flatten this in the search so it shows as:
"Order-no", "order-date", "price","quantity"
1 , 20/05/2017 , 1.0, 1
1 , 20/05/2017 , 2.0, 1
1 , 20/05/2017 , 3.0, 2
I've tried to use mvexpand, but it appears that it works on a individual column level and if i do a mvexpand on both of those last 2 columns, it effectively does a cross join on the entire data which causes incorrect values
Thanks in advance.
