| makeresults
| eval _raw="{\"_data\":{\"services\":[{\"id\":\"FB00000\",\"users\":[100,122]},{\"id\":\"FB11111\",\"users\":[404,797]}],\"socialNetwork\":\"FB\"},\"_timestamp\":\"01-02-02013T01:00:04.582+0100\",\"_type\":\"ServiceReport\"}"
| spath path=_data.services{} output=data
| kv
| rename data.services{}.* as *
| stats count by data.socialNetwork timestamp type data
| spath input=data
| stats count values(*) as * by users{}
| rename users{} as users, data.socialNetwork as socialNetwork
| table id users socialNetwork timestamp type
mvexpand gives "mvexpand output will be truncated due to excessive memory usage
Because of this kind of problem,
I thought of an expansion method that doesn't use mvexpand and mvzip .
The point is that the field that becomes multivalue is extracted once and expanded without using mvexpand by stats .
... View more
