I've already tried foreach, untable, and trim/mvappend in various combinations to solve this problem.
I have 30 columns of information (edit: And I don't want to specify them as they are dynamic), 1 column of text labels. I want to append pairs of the table together.
ex. data:
week |A-txt1 | B-txt1 | A-txt2 | B-txt2 etc...
0005 | 0002 | 00001 | 00003 | 00006
I want have column event data that looks like:
week | AB-txt1 |
0005 | 002:001 |
Ignore the leading zeros; I was trying to make the columns match up.
Can some wizard apply their sorcery?
Thanks.
Is this what you're looking for (this is a run-anywhere sample)
| makeresults | eval week="0005" | eval A-txt1="0002" | eval B-txt1="0001" | eval A-txt2="0003" | eval B-txt2="0006" | table week *txt* | untable week fields data | rex field=fields "(?<label>\w)-(?<text>\w+)" | table week label text data | mvcombine data delim=":" | stats values(label) as label values(data) as data by week text | makemv label delim="_" | makemv data delim=":" | eval field=label."-".text | xyseries week field data
Following is with eval for 4 sample fields A-txt1, B-txt1, A-txt2, B-txt2:
<your base search> | eval AB-txt1='A-txt1' + ":" + 'B-txt1' | eval AB-txt2='A-txt2' + ":" + 'B-txt2' | table _time week AB-txt1 AB-txt2
Following is with foreach for above eval(you can have n number of fields below, However, final table comand needs to be adjusted:
<your base search> | foreach *-txt* matchseg2="#matchseg2#" [eval AB-txt#matchseg2#='A-txt#matchseg2#' + ":" + 'B-txt#matchseg2#'] | table week AB-txt1 AB-txt2
...| eval a=mvzip(a-txt1,b-txt1) | eval b=mvzip(a,c-txt1) | ...
So on an so forth...
Is this what you're looking for (this is a run-anywhere sample)
| makeresults | eval week="0005" | eval A-txt1="0002" | eval B-txt1="0001" | eval A-txt2="0003" | eval B-txt2="0006" | table week *txt* | untable week fields data | rex field=fields "(?<label>\w)-(?<text>\w+)" | table week label text data | mvcombine data delim=":" | stats values(label) as label values(data) as data by week text | makemv label delim="_" | makemv data delim=":" | eval field=label."-".text | xyseries week field data
| strcat A-txt1 ":" B-txt1 AB-text1
This will create the field you want.