I have a search that does the following:
| inputlookup system_scores.csv
| search "big search goes here"
| fields server_org both_server_desktop_score desktop_score server_score
The search gives me the following:
server_org both_server_desktop_score desktop_score server_score
Bob 60 10 40
Alice 40 10 30
Jill 10 5 5
I would like to get each column into a row for each of the scores. My envision the search would look like this:
server_org server_type Score
Bob both_server_desktop_score 60
Bob desktop_score 10
Bob server_score 40
Alice both_server_desktop_score 40
Alice desktop_score 10
Alice server_score 30
Jill both_server_desktop_score 10
Jill desktop_score 5
Jill server_score 5
Is this possible? Any ideas?
...
| eval server_type=mvappend("both_server_desktop_score", "desktop_score", "server_score")
| eval Score=mvappend(both_server_desktop_score, desktop_score, server_score)
| eval combined=mvzip(server_type, Score, "=")
| fields server_org, combined
| mvexpand combined
| rex field=combined "(?<server_type>[^=]*)=(?<Score>.*)"
| table server_org, server_type, Score