Hello,
I have following XML loaded into filed 'data'.
<Step>
<stepEventName>Strin2</stepEventName>
<nextEventName>String5</nextEventName>
</Step>
<Step>
<stepEventName>String7</stepEventName>
</Step>
I am able to extract the 'stepEventName', 'nextEventNam' element values using below spath:
spath input=data output=StepEvent path=SummaryEvent.StepEvent.stepEventName |
spath input=data output=NextEvent path=SummaryEvent.StepEvent.nextEventName |
eval x=mvzip(NextEvent,StepEvent) | mvexpand x| eval x=split(x,",") | eval NextEvent=mvindex(x,0) | eval StepEvent=mvindex(x,1) | fillnull value="NULL" |table NextEvent,StepEvent
But when i try to display event list i do get below since nextEventName occured once in 'Step'
_time NextEvent StepEvent
timestamp String5 String2
But the below is what i want to display.
_time NextEvent StepEvent
timestamp String5 String2
timestamp NULL String5
How to get the NULL when nextEventName is not occured in 'Step'
Thanks in Advance
... View more