Hi. I have a search query returning the result as the following format:
Application Service Owner Location Status
=========== ======= ===== ======== ======
app1 srv_1 John Loc_1 1
app1 srv_2 John Loc_1 2
app1 srv_3 John Loc_1 3
app2 srv_1 Peter Loc_2 1
app2 srv_2 Peter Loc_2 4
app2 srv_3 Peter Loc_2 5
And I want to convert "Service" and "Status" into columns with this format:
Application Owner Location srv_1 srv_2 srv_3
=========== ===== ======== ===== ===== =====
app1 John Loc_1 1 2 3
app2 Peter Loc_2 1 4 5
Does anyone have any ideas?
Thanks a lot.
Try this
your current search | eval group=Application."#".Owner."#".Location | chart values(Status) as Status over group by Service | rex field=group "(?<Application>[^#]+)#(?<Owner>[^#]+)#(?<Location>.+)") | fields - group
Try this
your current search | eval group=Application."#".Owner."#".Location | chart values(Status) as Status over group by Service | rex field=group "(?<Application>[^#]+)#(?<Owner>[^#]+)#(?<Location>.+)") | fields - group
Thanks a lot.