Swap field and values

[muebel]

I have a list of fields within a Datamodel collected as values within the field named "unknown"

| datamodel Authentication Authentication 
| table * 
| spath 
| table fields{}.displayName 
| rename fields{}.displayName as unknown 
| mvexpand unknown

This gives:

I'd like to extend this search to give me a table with fields "dest_bunit", "dest_category" etc, all with a value of "unknown"

Ultimately this would be used as a subsearch within tstats to find events that have unknown values for any of the values within the datamodel.

More straightforward (and equally dynamic) would probably serve as an answer to this as well.

[somesoni2 · Accepted solution]

Try like this

| datamodel Authentication Authentication 
 | table * 
 | spath 
 | table fields{}.displayName 
 | rename fields{}.displayName as unknown 
 | mvexpand unknown | eval temp=1 | eval data="unknown" | xyseries temp unknown data | fields - temp

[muebel]

I had thought that xyseries and/or untable had something to do with the solution. I need to understand those commands better. Thanks!