Hi,
How can I write the name of a field in the value like I have :
test_1 | test_2 | test_3 |
warn | error | critical |
I want :
test |
test_1 - warn |
test_2 - error |
test_3 - critical |
I must do this for unknown fields (by now I have 3 tests but it can be more so it must be variable).
I thought to foreach command but I don't know how to do it.
Can you help me if this usecase is possible ?
There are couple of ways, for example
| makeresults
| eval _raw="test_1 test_2 test_3
warn error critical"
| multikv forceheader=1
| table test_*
| foreach test_*
[eval test=if(isnull(test),"<<FIELD>>"." - ".<<FIELD>>,mvappend(test,"<<FIELD>>"." - ".<<FIELD>>))]
| table test
or
| makeresults
| eval _raw="test_1 test_2 test_3
warn error critical"
| multikv forceheader=1
| table test_*
| transpose 0
| eval test=column." - ".'row 1'
| table test