Issue in combined field values?

[anu41]

I am having issue with "Status" values as below and screenshot, please find below json and search query.

Please advise!! Appreciate your help!

	EventDate( 21/10/2022)	EventDate( 20/10/2022)
Expected "Status"	DOCUMENT_ERROR:2 DOCUMENT_REQUEST_RECEIVED:2
Actual "Status"	DOCUMENT_REQUEST_RECEIVED:2	DOCUMENT_ERROR:2

|eval Status = mvzip('eventData{}.eventStatusCount{}.status', 'eventData{}.eventStatusCount{}.count', ":") | table "eventData{}.eventDate","eventData{}.ReceivedCount",
"eventData{}.ProcessedCount","eventData{}.MismatchCount","Status"
| rename eventData{}.eventDate as "EventDate",eventData{}.ReceivedCount as "Total Event Received Count", eventData{}.ProcessedCount as "Total Event Processed Count",
eventData{}.MismatchCount as "Total Event Mismatch Count"

"eventData": [
{
"eventDate": "2022-10-20",
"eventKey": "event.request",
"ProcessedCount": 0,
"eventStatusCount": [],
"ReceivedCount": 100,
"MismatchCount": 100
},
{
"eventDate": "2022-10-21",
"eventKey": "event.request",
"ProcessedCount": 2,
"eventStatusCount": [
{
"status": "DOCUMENT_ERROR",
"count": 2
},
{
"status": "DOCUMENT_REQUEST_RECEIVED",
"count": 2
}
],
"ReceivedCount": 1000,
"MismatchCount": 998
}
]

[ITWhisperer · Accepted solution]

You need to separate the eventData collection into separate events with mvexpand

| spath eventData{} output=eventData
| mvexpand eventData
| spath input=eventData
|eval Status = mvzip('eventStatusCount{}.status', 'eventStatusCount{}.count', ":") | table "eventDate","ReceivedCount",
"ProcessedCount","MismatchCount","Status"
| rename eventDate as "EventDate",ReceivedCount as "Total Event Received Count", ProcessedCount as "Total Event Processed Count",
MismatchCount as "Total Event Mismatch Count"

[anu41]

Thanks ITWhisperer !!!

The solution is working