I am running below Query
| makeresults| eval data="Brand1,File1,123;Brand1,File2,456;Brand2,File1,789;Brand2,File2,124;Brand3,File1,125;Brand3,File2,786"| makemv data delim=";" | rex field=data max_match=0 "(?<Brand>\w+\d+),(?<Files>\w+\d+)\,(?<Size>\d+)" | fields - _time,data | table Brand,Size,Files| chart values(Size) over Files by Brand
And want result in below format
Files Brand1 Brand2 Brand3
File1 123 789 125
File2 456 124 786
But result is coming as attached in picture. Whats wrong with the Query ?
Thanks guys.
All the above suggestions are working on this sample data.
But the first suggestion by @to4kawa worked for my actual data.
The data was in text format only not sure, why other two was not working.
Once again, thanks a lot for your suggestions
Thanks
Nilesh
From your result:
| makeresults
| eval data="Brand1,File1,123;Brand1,File2,456;Brand2,File1,789;Brand2,File2,124;Brand3,File1,125;Brand3,File2,786"
| makemv data delim=";"
| rex field=data max_match=0 "(?<Brand>\w+\d+),(?<Files>\w+\d+)\,(?<Size>\d+)"
| fields - _time,data
| table Brand,Size,Files
| rename COMMENT as "this is your sample , From here , the logic"
| eval _counter = mvrange(0,mvcount(Brand))
| stats list(*) as * by _counter
| foreach * [ eval <<FIELD>> = mvindex('<<FIELD>>' , _counter)]
| xyseries Brand Files Size
| transpose 0 header_field=Brand column_name=Files
More efficient:
| makeresults
| eval data="Brand1,File1,123;Brand1,File2,456;Brand2,File1,789;Brand2,File2,124;Brand3,File1,125;Brand3,File2,786"
| makemv data delim=";"
| stats count by data
| rex field=data "(?<Brand>\w+\d+),(?<Files>\w+\d+)\,(?<Size>\d+)"
| fields - _time,data,count
| chart sum(Size) by Files Brand
Hi folks.
Maybe, you want to extract these from JSON.
I create two query, How about these?
Hi
Check this
| makeresults
| eval data="Brand1,File1,123;Brand1,File2,456;Brand2,File1,789;Brand2,File2,124;Brand3,File1,125;Brand3,File2,786"
| makemv data delim=";"
| mvexpand data
| rex field=data max_match=0 "(?<Brand>\w+\d+),(?<Files>\w+\d+)\,(?<Size>\d+)"
| fields Brand,Files,Size
| eval {Brand}=Size
| fields - Brand, Size | stats values(*) as * by Files
Indeed. Key thing here is adding the | mvexpand data
. Otherwise you are working with a single row, with multivalued fields, which results in the outcome as per the screenshot.