Need help

[teewenjie22]

How to convert below 

_time    Server      col1     col2       col3

8am       SerA          1           2             3

9pm       SerA          5           6             7


into 

_time       Category          value        
8am           SerA_col1      1
8am           SerA_col2      2
8am           SerA_col3      3
9pm           SerB_col1      5
9pm           SerB_col2      6
9pm           SerB_col3      7

[kamlesh_vaghela]

@teewenjie22 

Try this. Update search as per your requirement. 

YOUR_SEARCH
| eval F="",V=""
| foreach col* [| eval F=if(F="","<<FIELD>>",F."|"."<<FIELD>>"), V=if(V="",'<<FIELD>>',V."|".'<<FIELD>>')]
| eval F=split(F,"|"),V=split(V,"|")
| eval t=mvzip(F,V) | fields - F V col*
| mvexpand t
| eval Category=Server."_".mvindex(split(t,","),0), value=mvindex(split(t,","),1) |fields time Category value

Sample:

| makeresults 
| eval _raw="time    Server      col1     col2       col3
8am       SerA          1           2             3
9pm       SerA          5           6             7" 
| multikv forceheader=1
| table time    Server      col1     col2       col3
| eval F="",V=""
| foreach col* [| eval F=if(F="","<<FIELD>>",F."|"."<<FIELD>>"), V=if(V="",'<<FIELD>>',V."|".'<<FIELD>>')]
| eval F=split(F,"|"),V=split(V,"|")
| eval t=mvzip(F,V) | fields - F V col*
| mvexpand t
| eval Category=Server."_".mvindex(split(t,","),0), value=mvindex(split(t,","),1) |fields time Category value

Thanks
KV
▄︻̷̿┻̿═━一

If this reply helps you, an upvote would be appreciated.