| rest splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/service fields="title,_key,kpis"  | spath input=value path={} output=svcs | mvexpand svcs  | fields - value  | spath input=svcs path=kpis{} output=kpis  | spath input=svcs path=title output=service_title  | spath input=svcs path=kpis{} output=kpi | fields - svcs, kpis  | mvexpand kpi  | spath input=kpi path=search_type output=search_type  | spath input=kpi path=type output=type  | spath input=kpi path=title output=kpi_title  | spath input=kpi path=base_search output=base_search  | spath input=kpi path=base_search_id output=base_search_id  | spath input=kpi path=_key output=search_id  | search type!=service_health  | fields service_title kpi_title search_type base_search_id search_id base_search 
0 comments