Selective display of values where column names are field values

[kenbaugher]

After looking at some examples online, I was able to come up with the below query, which can display one or more columns of data based on the selection of "sysname".

What we would like to do with this is optionally just two sysnames, and only the rows where the values do not match.

index=idx1 source="file1.log" sysname IN ("SYS1","SYS6")| table sysname value_name value_info | eval {sysname}=value_info | fields - sysname, value_info | stats values(*) as * by value_name

The data format is the below and there are a couple hundred value_names for each sysname with varying formats from integer values, to long strings

sysname, value_name, value_info

The above query displays the data something like this

value_name            SYS1                     SYS6
name1                       X                             Y
name2                       A                             A
name3                       B                             C

[ITWhisperer]

index=idx1 source="file1.log" sysname IN ("SYS1","SYS6")
| table sysname value_name value_info
| eventstats dc(value_info) as distinct_values by value_name
| where distinct_values > 1
| xyseries value_name sysname value_info

[kenbaugher]

perfect, thank you