I have multiple devices in a given location maintaining it lookup table with location and device.
Using location from index I am trying to get device list but output is coming in single row. I want list of devices as separate row. How to achieve it.
My query is like this
index =myindex
| lookup mylookup location OUTPUT devices
| table devices
Solved.
index = myindex
| lookup mylookup location OUTPUT devices
| stats count(devices) by location, devices
| table devices
Hi @ChetanArgekar,
please, try something like this:
index =myindex
| append [ | inputlookup mylookup | fields location devices ]
| stats values(devices) AS devices by location
| mvexpand devices
Ciao.
Giuseppe
thanks
It is giving only one device of location. I want list of every device of the location in separate row
Solved.
index = myindex
| lookup mylookup location OUTPUT devices
| stats count(devices) by location, devices
| table devices