Hi,
I have a query that evaluates the value of a variable like this
*...|eval var1= var2*10|....*
where var1 and var2 are variables.
Now I need to rename the column header by doing something like this
*rename column_name as "Number ".var1." is good"* .
But the output I see is *"Number ".var1." is good"*
and var1 is not getting replaced by the value. What is the right way of doing this ?
Any help will be appreciated.
rename
can't access column values. Try this:
... | eval Number {var1} is good = column_name | fields - column_name
rename
can't access column values. Try this:
... | eval Number {var1} is good = column_name | fields - column_name
what if variable is holding the column_name and then I want to sort that column.
for example
my_search | eval date="2023-02-02" | sort - $date
is it possible to sort by column name which is dynamically generated So i won't know the exact name But variable holds the column name So I can just use sort - $Variable?
Please post this as a new question rather than asking a different variant of another question on an 8 year old answer question. It will get more attention.
I really appreciate you sharing this example. It is bit confusing that it doesn't work for me when I have the value of var1 being calculated just after my query. When I moved this calculation just before the eval Number {var1} is good = column_name | fields - column_name, it worked for me.
Well, it can't use values from the future...
I mean
stats.....|eval var1=var2*10|....|....|......|....|eval Number {var1} is good = column_name | fields - column_name
didnot work for me.
It worked when I changed the above to
stats.....|....|....|......|....|eval var1=var2*10|eval Number {var1} is good = column_name | fields - column_name
Thanks @martin_muller for the quick reply. I tried your solution and now the column in the output now changed to "Number is good". It is not printing the value of var1 between "Number" and "is".