I have thise event:
ID=FAKE_ID_NAME,TS=1570441680,F1=1380,F2=60,F3=60,F4=1500
For my analysis it would be very usefull to get every field to a new line except ID and TS, so the desired output is:
ID=FAKE_ID_NAME,TS=1570441680,F1=1380;
ID=FAKE_ID_NAME,TS=1570441680,F2=60;
ID=FAKE_ID_NAME,TS=1570441680,F3=60;
ID=FAKE_ID_NAME,TS=1570441680,F4=1500;
How can I achieve this?
HI wvanloon,
try something like this:
| makeresults
| eval ID="FAKE_ID_NAME", TS="1570441680", F1="1380", F2="60", F3="60", F4="1500"
| eval col=ID." ".TS
| stats values(F1) AS F1 values(F2) AS F2 values(F3) AS F3 values(F4) AS F4 BY col
| untable col field value
| rex field=col "^(?<ID>[^ ]*)\s+(?<TS>[^ ]*)"
| eval my_field=field."=".value
| table ID TS my_field
Bye.
Giuseppe
Thanks!
Another problem is that I don't know which fields i have for each event.
So it can be 1F, 2F, 3F, 4F or something totally different like 1S, 2S, 6S and so on. I still want to duplicate the TS and ID column.
Can that also be solved?
what is the problem you are trying to solve?
I need to join the events based on 2 fields ID and the name of the other fields like F1.
So I have an lookup-table with:
ID;INDEX;Value
FAKE_ID_NAME;F1;95
If you have any other ideas to solve this that would be great!