hello
maybe my title is a little bit confusing.. i was not sure how to explain it in few words 🙂
i have fields, looks like :
RequestedHeadVoltagesSupport=24.9829,25.081,19,19,19,19,19,19
RequestedHeadVoltagesModel=23,23,28.8665,29.0513,27.7611,27.4205,27.6825,29.2477
i need to take parts of the string and set each part under different "head"
my query looks like :
(index=*_pj OR index=other) source=*HQ.cfg OR source=*HM.cfg OR RequestedHeadVoltagesSupport OR RequestedHeadVoltagesModel
| `SerialNumber`
| rex field=source "PerMachine_(?<MachineMode>[^\.]+)"
| eval MachineMode=if(MachineMode=="HM","HS/HM",MachineMode)
| rex "RequestedHeadVoltagesSupport=(?<head0>[^,]+),(?<head1>[^,]+),"
| rex "RequestedHeadVoltagesModel=[^,]+,[^,]+,(?<head2>[^,]+),(?<head3>[^,]+),(?<head4>[^,]+),(?<head5>[^,]+),(?<head6>[^,]+),(?<head7>[^,]+)"
| stats latest(head*) AS head* by source
|table head*
and the results are :
head0 head1 head2 head3 head4 head5 head6 head7
24.8697 24.4445 28.3751 26.8037 28.4493 27.0375 29.55 28.3208
24.8697 24.4445 28.3751 26.8037 28.4493 27.0375 29.55 28.3208
24.8697 24.4445 28.3751 26.8037 28.4493 27.0375 29.55 28.3208
24.8697 24.4445 28.3751 26.8037 28.4493 27.0375 29.55 28.3208
24.8697 24.4445 28.3751 26.8037 28.4493 27.0375 29.55 28.3208
24.8697 24.4445 28.3751 26.8037 28.4493 27.0375 29.55 28.320
for the query i posted the results are reasonable but what i want to achieve is the my table will look like:
Head RequestedHeadVoltagesSupport
RequestedHeadVoltagesModel 0
results of head 0 1
results of head 1 2
results of head 2 3
results of head 3 4
....
... View more