Hello All,
I have a data like this
X1=[A(status=X, reason=Y), A(status=Z, reason=Y), A(status=xyz, reason=abc)]
Now when I am using the query <search criteria> | table status, reason
it is giving values "X" and "Y"
1. Trying to understand why it is not considering the values Z & Y and xyz & abc
2. If I have to get the result of values Z & Y and xyz & abc how to retrieve?
sample query:
| makeresults
| eval _raw="service: mnp, o=123, X1=[A(status=X, reason=Y), A(status=Z, reason=Y), A(status=xyz, reason=abc)]"
| rex max_match=0 "status=(?<status>\w+), reason=(?<reason>\w+)"
| table status reason
| eval _counter = mvrange(0,mvcount(status))
| stats list(*) as * by _counter
| foreach * [ eval <<FIELD>> = mvindex('<<FIELD>>', _counter)]
| fields - _*
recommend:
<search criteria>
| rex max_match=0 "status=(?<status>\w+), reason=(?<reason>\w+)"
| fields status reason
| eval _counter = mvrange(0,mvcount(status))
| stats list(*) as * by _counter
| foreach * [ eval <<FIELD>> = mvindex('<<FIELD>>', _counter)]
| fields - _*
| table status, reason
Hello @to4kawa
It is still giving me values "X" and "Y"
use where
OR search
I am only using where
but still the same
I see, your query is wrong
Hi @to4kawa
can you please explain a bit more when you say the query is wrong? What I meant above is in the complete query I am not using search
instead using where
service
| where not reason like "%P%"
|table status, reason
| where not reason like "%P%"
This can't work.
where "%P%"
come from?
Don't you select NOT (status="X" AND reason="Y")
?
What is <search criteria>
?
Hi @richgalloway the raw data is like service: mnp, o=123, X1=[A(status=X, reason=Y), A(status=Z, reason=Y), A(status=xyz, reason=abc)]
and my <search criteria>
is service