- Apps and Add-ons
- :
- All Apps and Add-ons
- :
- Re: How to set FIELDA to value(FIELDB) inline sear...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to set FIELDA to value(FIELDB) inline search... replacing case statement
Wasn't sure how title this one. We are to do feed multiple different events into same dashboards interfaces built in sideview. I would like to be able to stream multiple types of events into same interface where I lookup which field should be displayed in DISPLAY_FIELD....
Currently...
search (returning events with a TYPE field which dictates which field DISPLAY_FIELD should be set to... )
| eval DISPLAY_FIELD=case(TYPE=TYPE1, DISPLAY_FIELD1, TYPE=TYPE2, DISPLAY_FIELD2, , TYPE=TYPE3, DISPLAY_FIELD3,...)
Would like to figure out how to replace case with a lookup
search ....
| lookup DISPLAY_FIELD_NAMES TYPE OUTPUT DISPLAY_FIELD_NAME
| eval DISPLAY_FIELD=value(DISPLAY_FIELD_NAME)
After reviewing solution offered, thinking this may make sense as a custom search command in python or javascript... I am not a formal programmer so haven't worked in those languages or build custom commands before. Thoughts and/or code examples welcome.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thinking this may make sense as a custom search command in python or javascript... I am not a formal programmer so haven't worked in those languages or build custom commands before. Thoughts?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Give this a try
Your base search | stats count by TYPE | lookup DISPLAY_FIELD_NAMES TYPE OUTPUT DISPLAY_FIELD_NAME
| map maxsearches=100 search="Your base search (replace all double quotes with \doublequote| eval DISPLAY_FIELD=$DISPLAY_FIELD_NAME$"
A sample runanywhere example for this is below:
| gentimes start=-1 | eval DisplayField="Last" | map maxsearches=100 search="| gentimes start=-1 | eval First=\"Somesh\" | table First | eval Last=\"Soni\" | eval Result=$DisplayField$"
Edit | eval DisplayField="Last" value to "First" to see the change in Result field value.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Will give it a try thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How may rows do you have in your base search. There is one method this might work but its not efficient in terms of performance, so no of rows matters.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Right now we are heading at 1000 for one interface but I would like to up that... say 10000 max. Thanks!
Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
