How to convert below
_time Server col1 col2 col3
8am SerA 1 2 3
9pm SerA 5 6 7
into
_time Category value
8am SerA_col1 1
8am SerA_col2 2
8am SerA_col3 3
9pm SerB_col1 5
9pm SerB_col2 6
9pm SerB_col3 7
Try this. Update search as per your requirement.
YOUR_SEARCH
| eval F="",V=""
| foreach col* [| eval F=if(F="","<<FIELD>>",F."|"."<<FIELD>>"), V=if(V="",'<<FIELD>>',V."|".'<<FIELD>>')]
| eval F=split(F,"|"),V=split(V,"|")
| eval t=mvzip(F,V) | fields - F V col*
| mvexpand t
| eval Category=Server."_".mvindex(split(t,","),0), value=mvindex(split(t,","),1) |fields time Category value
Sample:
| makeresults
| eval _raw="time Server col1 col2 col3
8am SerA 1 2 3
9pm SerA 5 6 7"
| multikv forceheader=1
| table time Server col1 col2 col3
| eval F="",V=""
| foreach col* [| eval F=if(F="","<<FIELD>>",F."|"."<<FIELD>>"), V=if(V="",'<<FIELD>>',V."|".'<<FIELD>>')]
| eval F=split(F,"|"),V=split(V,"|")
| eval t=mvzip(F,V) | fields - F V col*
| mvexpand t
| eval Category=Server."_".mvindex(split(t,","),0), value=mvindex(split(t,","),1) |fields time Category value
Thanks
KV
▄︻̷̿┻̿═━一
If this reply helps you, an upvote would be appreciated.