I have an event in the below format.
INCIDENT_ID PROBLEM_KEY CREATE_TIME
-------------------- ----------------------------------------------------------- ----------------------------------------
102753 ORA 15064 2018-05-24 15:38:50.242000 -04:00
107689 ORA 29740 2018-05-24 17:04:00.414000 -04:00
112801 ORA 32701 2018-05-24 20:59:14.420000 -04:00
I need this data as INCIDENT_ID field with values (102753, 107689, 112801), and PROBLEM_KEY, CREATE_TIME fields in same way. I used multikv command, but I am not getting the desired result.
base search | multikv fields INCIDENT_ID PROBLEM_KEY CREATE_TIME | table INCIDENT_ID PROBLEM_KEY CREATE_TIME
I got the desired output by using below command.
base search | multikv | table INCIDENT_ID PROBLEM_KEY CREATE_TIME
I got the desired output by using below command.
base search | multikv | table INCIDENT_ID PROBLEM_KEY CREATE_TIME
What's the current output looks like and what should be the expected output?
I need 3 fileds(INCIDENT_ID, PROBLEM_KEY, CREATE_TIME) should get created at run time. When I use table command to print these fields respective column value should come in that field.
@twh1, if its currently displaying as a single row, then try
your search|eval z=mvzip(mvzip( INCIDENT_ID ,PROBLEM_KEY,"," ),CREATE_TIME,"," )|fields z|mvexpand z|eval s=split(z,",")|eval INCIDENT_ID=mvindex(s,0),PROBLEM_KEY=mvindex(s,1),CREATE_TIME=mvindex(s,2)|fields INCIDENT_ID,PROBLEM_KEY,CREATE_TIME
Hi @renjith.nair
I tried above query but didn't get the desired output.