For example, I have the following table with 3 columns and 2 rows:
A B C
1 2 3
4 5 6
I want to transform this table and receive the following:
D C
1 3
4 6
2 3
5 6
Following is a run anywhere search for your problem:
| makeresults
| eval A=1,B=2,C=3
| append [| makeresults
| eval A=4,B=5,C=6]
| fields - _time
| eval D = A.",".B
| fields - A B
| makemv delim="," D
| mvexpand D
Query until fields _time is used to generate mock data as per question.
Similar approach with mvzip
| eval D = mvzip(A,B)
| fields - A B
| makemv delim="," D
| mvexpand D
@pdanilchenko, were you able to test the suggested query?
I divided my initial request into two and then apply append to them.
D C
1 3
4 6
append
D C
2 3
5 6
Ok sure. That is why context of the problem is required for us as well to assist. You should still try to see whether there is a feasibility of achieving the same result without append for which we would need to see your existing query. If not please convert your comment to answer and accept the same.
@pdanilchenko, it will be helpful if you can give us a glimpse of your final transforming query which generate table with columns A B and C. Because there might be a feasibility of coming down to table with columns D and C directly.