I have this Query that produces two multi value fields, keys and values. What i need to do is pair each entry in the keys multivalue field with it's matching value in the values multivalue field to create a json object that looks like this.
{ key1:val1, key2:val2, key3:val3 }
index=test5 earliest=@s-24h
apicall IN (aws_es_listDomainNames aws_es_listTags) NOT err
| eval resourceid=coalesce(resourceid, DomainName)
| eval uid=resourceid+accountid+region
| rename "TagList{}.Key" AS keys
| rename "TagList{}.Value" AS values
| eval tags=mvzip('keys','values'," = ") | nomv tags. // this matches up the key and value pairs but isn't useful with json_object.
I've tried using json_object but json_object only accepts arguments and not a string of key value pairs. Is there a way to produce a json object from the two multivalue fields above?
Thanks.
... View more
