Hello,
I have following XML loaded into filed 'data'.
Strin2 String5 String7
I am able to extract the 'stepEventName', 'nextEventNam' element values using below spath:
spath input=data output=StepEvent path=SummaryEvent.StepEvent.stepEventName |
spath input=data output=NextEvent path=SummaryEvent.StepEvent.nextEventName |
eval x=mvzip(NextEvent,StepEvent) | mvexpand x| eval x=split(x,",") | eval NextEvent=mvindex(x,0) | eval StepEvent=mvindex(x,1) | fillnull value="NULL" |table NextEvent,StepEvent
But when i try to display event list i do get below since nextEventName occured once in 'Step'
-------------------------------------
_time NextEvent StepEvent
-------------------------------------
timestamp String5 String2
But the below is what i want to display.
-------------------------------------
_time NextEvent StepEvent
-------------------------------------
timestamp String5 String2
timestamp NULL String5
How to get the NULL when nextEventName is not occured in 'Step'
Thanks in Advance
↧