How to divide each line and data row?

[htramtran83]

ServiceTitle                            KPITitle                                                                           kpis_key
SmartCas                                   ServiceHealthScore                                                  SHKPI-17c3399b-d559-4e91
                                               CPU Utilization: %                                                            793faace-3431-4d54-a54c-f07fbb520425
                                                   IOWait %                                                                       9e984025-b4ba-43c1-a165
                                                   Storage Operations: Latency                                       3d063082-9fe2-48f4
                                                 GC-Major Collection Time Spent Per Min :                 33a4d376ed6e7d5aa0be31b1

The search I run is :

| inputlookup service_kpi_lookup| rename title as ServiceTitle kpis.title as KPITitle 

| fields ServiceTitle, KPITitle, kpis_key

How can I run each of line of service name is same row of KPI title and kpi key (it doesn't matter if duplicate)

thank you.

[htramtran83 · Accepted solution]

I have my own answer,
I used the query with mvzip and mvindex:
my search
| eval kpis_info = mvzip(mvzip(mvzip(kpis_key, kpis_base_search, "==@@=="), kpis_search_type, "==@@=="), kpis_title, "==@@==")
| mvexpand kpis_info
| eval kpis_info=split(kpis_info, "==@@==")
| eval kpis_base_search=mvindex(kpis_info, 1)
| eval kpis_key=mvindex(kpis_info,0)
| eval kpis_title=mvindex(kpis_info,3)
| eval kpis_search_type=mvindex(kpis_info,2)

[richgalloway]

Please share the format of your CSV file.

[richgalloway]

Try

| inputlookup service_kpi_lookup| rename title as ServiceTitle kpis.title as KPITitle
| filldown ServiceTitle
| fields ServiceTitle, KPITitle, kpis_key

[htramtran83]

hi,

thank you for your answer.
It doesn't work unfortunately. The result is the same with the full list of KPITilte and one line of ServiceTitle.

I also try something with mvzip and mvindex, I return with wrong code.
| inputlookup service_kpi_lookup
| eval field=mvzip(mvzip(kpis._key,kpis.tilte),sec_grp)
| stats count by title field
| eval kpis_key=mvindex(split(field,","),0), KPITitle=mvindex(split(field,",")1)

[htramtran83]

I have my own solution with :
my search...
| eval kpis_info = mvzip(mvzip(mvzip(kpis_key, kpis_base_search, "==@@=="), kpis_search_type, "==@@=="), kpis_title, "==@@==")
| mvexpand kpis_info
| eval kpis_info=split(kpis_info, "==@@==")
| eval kpis_base_search=mvindex(kpis_info, 1)
| eval kpis_key=mvindex(kpis_info,0)
| eval kpis_title=mvindex(kpis_info,3)
| eval kpis_search_type=mvindex(kpis_info,2)