ServiceTitle KPITitle kpis_key
SmartCas ServiceHealthScore SHKPI-17c3399b-d559-4e91
CPU Utilization: % 793faace-3431-4d54-a54c-f07fbb520425
IOWait % 9e984025-b4ba-43c1-a165
Storage Operations: Latency 3d063082-9fe2-48f4
GC-Major Collection Time Spent Per Min : 33a4d376ed6e7d5aa0be31b1
The search I run is :
| inputlookup service_kpi_lookup| rename title as ServiceTitle kpis.title as KPITitle
| fields ServiceTitle, KPITitle, kpis_key
How can I run each of line of service name is same row of KPI title and kpi key (it doesn't matter if duplicate)
thank you.
I have my own answer,
I used the query with mvzip and mvindex:
my search
| eval kpis_info = mvzip(mvzip(mvzip(kpis_key, kpis_base_search, "==@@=="), kpis_search_type, "==@@=="), kpis_title, "==@@==")
| mvexpand kpis_info
| eval kpis_info=split(kpis_info, "==@@==")
| eval kpis_base_search=mvindex(kpis_info, 1)
| eval kpis_key=mvindex(kpis_info,0)
| eval kpis_title=mvindex(kpis_info,3)
| eval kpis_search_type=mvindex(kpis_info,2)
I have my own answer,
I used the query with mvzip and mvindex:
my search
| eval kpis_info = mvzip(mvzip(mvzip(kpis_key, kpis_base_search, "==@@=="), kpis_search_type, "==@@=="), kpis_title, "==@@==")
| mvexpand kpis_info
| eval kpis_info=split(kpis_info, "==@@==")
| eval kpis_base_search=mvindex(kpis_info, 1)
| eval kpis_key=mvindex(kpis_info,0)
| eval kpis_title=mvindex(kpis_info,3)
| eval kpis_search_type=mvindex(kpis_info,2)
Please share the format of your CSV file.
Try
| inputlookup service_kpi_lookup| rename title as ServiceTitle kpis.title as KPITitle
| filldown ServiceTitle
| fields ServiceTitle, KPITitle, kpis_key
hi,
thank you for your answer.
It doesn't work unfortunately. The result is the same with the full list of KPITilte and one line of ServiceTitle.
I also try something with mvzip and mvindex, I return with wrong code.
| inputlookup service_kpi_lookup
| eval field=mvzip(mvzip(kpis._key,kpis.tilte),sec_grp)
| stats count by title field
| eval kpis_key=mvindex(split(field,","),0), KPITitle=mvindex(split(field,",")1)
I have my own solution with :
my search...
| eval kpis_info = mvzip(mvzip(mvzip(kpis_key, kpis_base_search, "==@@=="), kpis_search_type, "==@@=="), kpis_title, "==@@==")
| mvexpand kpis_info
| eval kpis_info=split(kpis_info, "==@@==")
| eval kpis_base_search=mvindex(kpis_info, 1)
| eval kpis_key=mvindex(kpis_info,0)
| eval kpis_title=mvindex(kpis_info,3)
| eval kpis_search_type=mvindex(kpis_info,2)