The gentimes searches just generate some data. This is repeated in the filter search but this is just to get find all the fields which match *_Employeestatus. These are then transposed so column has all these field names. For each field name, create a mv-field with all the values you want to match on, mvexpand this to create a row for each *_Employeestatus field crossed with each value. Then return a field for each *_Employeestatus field with the value to be searched. This becomes your search filter. | gentimes start=-1 increment=1h
| rename starttime as _time
| fields _time
| eval initial_Employeestatus=mvindex(split("fired,working,exit,,relocated",","),random()%4)
| eval current_Employeestatus=mvindex(split("fired,working,exit,,relocated",","),random()%4)
| eval future_Employeestatus=mvindex(split("fired,working,exit,,relocated",","),random()%4)
| search
[| gentimes start=-1 increment=1h
| rename starttime as _time
| fields _time
| eval initial_Employeestatus=mvindex(split("fired,working,exit,,relocated",","),random()%4)
| eval current_Employeestatus=mvindex(split("fired,working,exit,,relocated",","),random()%4)
| eval future_Employeestatus=mvindex(split("fired,working,exit,,relocated",","),random()%4)
| stats values(*_Employeestatus) as *_Employeestatus
| transpose 0
| eval status=split("exit,,relocated",",")
| fields column status
| mvexpand status
| eval {column}=status
| fields - column status]
... View more
