Search:
index=exp eventName="business:SelfServ-ChangeTrip" ChangeBookingEventType=ChangeBookingPayloadChunk hotelChangePayloadId="24c51841-8188-448b-9f4a-26f978ae4af9"
| sort chunkSequence
| fields payload
Results:
date payload
XXXX String 1-
XXXX String 2-
I'd like the result to be:
date payload
XXXX String 1-String 2-
Obviously I don't care about the date, but I can't seem to get rid of it with fields -_*
without messing up the entire search.
Do something like this
index=exp eventName="business:SelfServ-ChangeTrip" ChangeBookingEventType=ChangeBookingPayloadChunk hotelChangePayloadId="24c51841-8188-448b-9f4a-26f978ae4af9"
| sort chunkSequence | stats list(payload) as payload | nomv payload
Do something like this
index=exp eventName="business:SelfServ-ChangeTrip" ChangeBookingEventType=ChangeBookingPayloadChunk hotelChangePayloadId="24c51841-8188-448b-9f4a-26f978ae4af9"
| sort chunkSequence | stats list(payload) as payload | nomv payload
This worked great except when the payload field contains a comma. When it runs into a comma the resulting string gets truncated. I imagine I can do something to "list(payload)" but not sure.
Works for me:
|noop|stats count as field|eval field="a,b,c,d,e" | makemv delim="," field | rex field=field mode=sed "s/c/c,/" | nomv field