I have this search/report:
host=app-dev-001 terminating OR rehire | convert timeformat="%Y-%m-%d" ctime(_time) AS date | table date rehire term_user
This gives me this result:
I would like to get term_user values to start showing up on row 1.
Is there something like python's zip_longest function?
import itertools
for u1, u2 in itertools.zip_longest(l1, l2):
... print(u1, u2)
...
omikusarl ahubshs
chasinnb egathnls
yeanvked mfdhaaar
kkldjuga iuvdcahe
aarehdv swusrbib
vikdho3n rcathrki
None jduakdf
None loidjht
host=app-dev-001 rehire
| convert timeformat="%Y-%m-%d" ctime(_time) AS date
| table date rehire
| appendcols [search host=app-dev-001 terminating
| table term_user]
| fillnull rehire term_user value="None"
I don't know zip_longest
. how about this?
If there is the key field, you can use stats
.
host=app-dev-001 rehire
| convert timeformat="%Y-%m-%d" ctime(_time) AS date
| table date rehire
| appendcols [search host=app-dev-001 terminating
| table term_user]
| fillnull rehire term_user value="None"
I don't know zip_longest
. how about this?
If there is the key field, you can use stats
.
awesome thanks! That's just what I needed.