Hi,
I want to something like - append [Query-2] by clause
Situation is I have a result set from query-1 and query-2 as given in first table and second table respectively.
I want to append the result of query-2 multiple times based on logical change in project value at the end as given in expected output table. This is like - append [Query-2] by Project
Normal append result is provided in current output table.
Any help is appreciated.
.
That was a fun one!
| makeresults
| eval raw="Project_a,Sprint_1,5
Project_a,Sprint_2,10
Project_a,Sprint_3,4
Project_a,Sprint_4,3
Project_b,Sprint_1,20
Project_b,Sprint_2,3
Project_b,Sprint_3,5
Project_b,Sprint_4,4
Project_c,Sprint_1,4
Project_c,Sprint_2,8
Project_c,Sprint_3,4
Project_c,Sprint_4,5"
| makemv delim="
" raw
| mvexpand raw
| rename raw AS _raw
| rex "^(?<Project>[^,]+),(?<Sprint>[^,]+),(?<points>.*)$"
| fields - _*
| rename COMMENT AS "Everything above should be replaced with your 'Query-1'"
| eval Sprint_and_points = Sprint . ":" . points
| stats list(Sprint_and_points) AS Sprint_and_points BY Project
| append
[| makeresults
| eval Sprint="Future_1 Future_2"
| makemv Sprint
| mvexpand Sprint
| fields - _*
| rename COMMENT AS "Everything inside of this append should be replaced with your 'Query-2'"]
| eventstats list(Sprint) AS Sprints
| where isnull(Sprint)
| eval Sprint = mvappend(Sprint_and_points, Sprints)
| fields Project Sprint
| mvexpand Sprint
| rex field=Sprint "^(?<Sprint>[^:]+):(?<points>.*)$"
Try this!
search Query-1
| append
[search Query-1
|dedup Project
|map search="search Query-2|eval Project=\"$Project$\""
|fields Project,Sprint]
|sort Project