I have this Query that produces two multi value fields, keys and values. What i need to do is pair each entry in the keys multivalue field with it's matching value in the values multivalue field to create a json object that looks like this.
{ key1:val1, key2:val2, key3:val3 }
Hi, I think something like this will work
| makeresults
| eval json="{ \"stuff\":[{\"name\": \"name0\", \"value\": \"value0\"},{\"name\": \"name1\", \"value\": \"value1\"}] }"
| spath input=json
| rename "stuff{}.name" as names,
"stuff{}.value" as values,
| eval range=mvrange(0,mvcount(names)),
stuff=mvmap(range,"\"".mvindex(names,range)."\":\"".mvindex(values,range)."\"")
| nomv stuff
| eval stuff="{".replace(stuff,"\n",",")."}"
| table json stuff
My bad. This is a bit cleaner. Clearly I'm up too late and forgot about mvjoin
| makeresults
| eval json="{ \"stuff\":[{\"name\": \"name0\", \"value\": \"value0\"},{\"name\": \"name1\", \"value\": \"value1\"}] }"
| spath input=json
| rename "stuff{}.name" as names,
"stuff{}.value" as values,
| eval range=mvrange(0,mvcount(names)),
stuff=mvmap(range,"\"".mvindex(names,range)."\":\"".mvindex(values,range)."\""),
stuff=mvjoin(stuff,",")
| eval stuff="{".stuff."}"
| table json stuff
excellent!! Thank you.