Hi @alesyo How about this? You would just need to use this on your existing query I think | foreach *
[| eval summary=mvappend(summary,IF(<<FIELD>>!="" and "<<FIELD>>"!="id", "<<FIELD...
See more...
Hi @alesyo How about this? You would just need to use this on your existing query I think | foreach *
[| eval summary=mvappend(summary,IF(<<FIELD>>!="" and "<<FIELD>>"!="id", "<<FIELD>>=".<<FIELD>>,null()))]
| eval summary_output="Id:".id." - ".mvjoin(summary," ")
| fields summary_output However I've included a full working example below: | makeresults
| eval data="[{\"id\":1,\"dest_ip\":\"1.1.1.1\",\"src_ip\":\"2.2.2.2\"},{\"id\":2,\"user\":\"bob\",\"domain\":\"microsoft\"},{\"id\":3,\"county\":\"usa\",\"city\":\"seattle\"},{\"id\":4,\"company\":\"cisco\",\"product\":\"splunk\"}]"
| eval rawdata=json_array_to_mv(data)
| mvexpand rawdata
| eval _raw=json_extract(rawdata,"")
| fields - data rawdata
| spath
| stats values(*) AS * by id
| foreach *
[| eval summary=mvappend(summary,IF(<<FIELD>>!="" and "<<FIELD>>"!="id", "<<FIELD>>=".<<FIELD>>,null()))]
| eval summary_output="Id:".id." - ".mvjoin(summary," ")
| fields summary_output Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will