I am having issue with "Status" values as below and screenshot, please find below json and search query.
Please advise!! Appreciate your help!
EventDate( 21/10/2022)
EventDate( 20/10/2022)
Expected "Status"
DOCUMENT_ERROR:2 DOCUMENT_REQUEST_RECEIVED:2
Actual "Status"
DOCUMENT_REQUEST_RECEIVED:2
DOCUMENT_ERROR:2
|eval Status = mvzip('eventData{}.eventStatusCount{}.status', 'eventData{}.eventStatusCount{}.count', ":") | table "eventData{}.eventDate","eventData{}.ReceivedCount", "eventData{}.ProcessedCount","eventData{}.MismatchCount","Status" | rename eventData{}.eventDate as "EventDate",eventData{}.ReceivedCount as "Total Event Received Count", eventData{}.ProcessedCount as "Total Event Processed Count", eventData{}.MismatchCount as "Total Event Mismatch Count"
"eventData": [ { "eventDate": "2022-10-20", "eventKey": "event.request", "ProcessedCount": 0, "eventStatusCount": [], "ReceivedCount": 100, "MismatchCount": 100 }, { "eventDate": "2022-10-21", "eventKey": "event.request", "ProcessedCount": 2, "eventStatusCount": [ { "status": "DOCUMENT_ERROR", "count": 2 }, { "status": "DOCUMENT_REQUEST_RECEIVED", "count": 2 } ], "ReceivedCount": 1000, "MismatchCount": 998 } ]
... View more