Hi,
How can I write the name of a field in the value like I have :
| test_1 | test_2 | test_3 |
| warn | error | critical |
I want :
| test |
| test_1 - warn |
| test_2 - error |
| test_3 - critical |
I must do this for unknown fields (by now I have 3 tests but it can be more so it must be variable).
I thought to foreach command but I don't know how to do it.
Can you help me if this usecase is possible ?
There are couple of ways, for example
| makeresults
| eval _raw="test_1 test_2 test_3
warn error critical"
| multikv forceheader=1
| table test_*
| foreach test_*
[eval test=if(isnull(test),"<<FIELD>>"." - ".<<FIELD>>,mvappend(test,"<<FIELD>>"." - ".<<FIELD>>))]
| table testor
| makeresults
| eval _raw="test_1 test_2 test_3
warn error critical"
| multikv forceheader=1
| table test_*
| transpose 0
| eval test=column." - ".'row 1'
| table test