I want to something like - append [Query-2] by clause
Situation is I have a result set from query-1 and query-2 as given in first table and second table respectively.
I want to append the result of query-2 multiple times based on logical change in project value at the end as given in expected output table. This is like - append [Query-2] by Project
Normal append result is provided in current output table.
Any help is appreciated.
That was a fun one!
| makeresults | eval raw="Project_a,Sprint_1,5 Project_a,Sprint_2,10 Project_a,Sprint_3,4 Project_a,Sprint_4,3 Project_b,Sprint_1,20 Project_b,Sprint_2,3 Project_b,Sprint_3,5 Project_b,Sprint_4,4 Project_c,Sprint_1,4 Project_c,Sprint_2,8 Project_c,Sprint_3,4 Project_c,Sprint_4,5" | makemv delim=" " raw | mvexpand raw | rename raw AS _raw | rex "^(?<Project>[^,]+),(?<Sprint>[^,]+),(?<points>.*)$" | fields - _* | rename COMMENT AS "Everything above should be replaced with your 'Query-1'" | eval Sprint_and_points = Sprint . ":" . points | stats list(Sprint_and_points) AS Sprint_and_points BY Project | append [| makeresults | eval Sprint="Future_1 Future_2" | makemv Sprint | mvexpand Sprint | fields - _* | rename COMMENT AS "Everything inside of this append should be replaced with your 'Query-2'"] | eventstats list(Sprint) AS Sprints | where isnull(Sprint) | eval Sprint = mvappend(Sprint_and_points, Sprints) | fields Project Sprint | mvexpand Sprint | rex field=Sprint "^(?<Sprint>[^:]+):(?<points>.*)$"