i have data something like this input:   firstname=value1,lastname=value2,email=value3,address=value4.. etc firstname=value11,lastname=value12,email=value13,address=value14.. etc firstname=value12,lastname=value13,email=value14,address=value15.. etc   output:   firstname lastname email address value1 value2, value3, value4 value11 value12, value13, value14 value12 value13, value14, value15   i want to extract this data into a table with keys as column headers. Please note these keys are dynamic and it can have any names. i tried      search | extract pairdelim="," kvdelim="="   but not sure how to put them into a table format. any inputs? ... View more

|query | stats count by app_status| eventstats sum(count) as totalCount | eval percentage=round((count/totalCount)*100,3) | fields - count totalCount | chart max(percentage) by app_status i want to show results in bar chart. with above query i am able to see the bar chart, but all bars have same color. is there way to show different colors for each bar? thanks in advance ... View more

For example: raw data is 100,x,info=1,error=1,warn=1 101,x,info=1,error=1,warn=1 101,y,info=1,error=2,warn=1 101,y,info=1,error=3,warn=1 | query | chart count by x y | addtotals col=true labelfield=x label="Totals" Sample results event, info, error, warn Total x 2 2 2 6 y 2 5 2 9 Totals 4 7 4 15 In the above query I want to sort the data based on group by query results in desc order. when i try | sort 0 -Totals, Totals column appearing first row in table. | query | chart count by x y | addtotals col=true labelfield=x label="Totals" | sort 0 -Total Result: event, info, error, warn Total Totals 4 7 4 15 y 2 5 2 9 x 2 2 2 6 But I want to display results as event, info, error, warn Total y 2 5 2 9 x 2 2 2 6 Totals 4 7 4 15 Any inputs here really helps me. Thanks ... View more

Hi I am trying to extract data from 2 multivalue fields and trying to form key value pair, for example, I have data something like below _time, field1 , field2 10000, x:y:z 10:20:30 10001, a:b:c 40:50:60 I want to extract data something like this 10000, x 10 10000, y 20 10000, z 30 10001, a 40 10001, b 50 10001, c 60 I tried with makemv but not able to get the result in above format. any input is really appreciated. Thanks. ... View more