I have a field named severity. It has three possible values, 1,2, or 3. I want to rename this field to red if the field value is 1. I want to rename the field name to yellow if the value is 2. And I want to name the field to red if the value is 3. How can I renamed a field based on a condition?
Hi HMTODD,
try this run everywhere search to see an example how it can be done:
| gentimes start=-1
| eval severity ="1 2 3"
| makemv severity
| mvexpand severity
| rename comment AS "Here starts the real code"
| eval red=case(severity="1", 1, severity="3", 3, 1=1, null()), yellow=case(severity="2", 2, 1=1, null())
The first 5 lines just create fake events and the eval created a field called red
or yellow
based on the severity
field. You can process the results further and remove the severity
field with table
or fields
if it's not needed. You can also another eval
to get a field called green
if needed.
Hope this helps ...
cheers, MuS
@HMTODD, can you add your query with the final transforming command? Also the data as displayed by current query? Are there any other fields besides severity that you are interested in and are being currently displayed in the final output?
Do you really want to name the field as red
if the value is either 1 or 3?
Hi HMTODD,
try this run everywhere search to see an example how it can be done:
| gentimes start=-1
| eval severity ="1 2 3"
| makemv severity
| mvexpand severity
| rename comment AS "Here starts the real code"
| eval red=case(severity="1", 1, severity="3", 3, 1=1, null()), yellow=case(severity="2", 2, 1=1, null())
The first 5 lines just create fake events and the eval created a field called red
or yellow
based on the severity
field. You can process the results further and remove the severity
field with table
or fields
if it's not needed. You can also another eval
to get a field called green
if needed.
Hope this helps ...
cheers, MuS
Thanks. The big win for me was the case command. Here is a bit of detail on my problem and how it has been solved with your help.
I wanted to create a single color pie chart that would be red OR yellow OR green depending on the value of the field named severity. The search results that I am working with is a single field, severity, and the value, either a 1, or 2, or 3.
I solved this with the following.
eval color=case(severity="1","red",severity="2","yellow",severity="3","green") | chart count by color
combined with this customer pie chart option
<option name="charting.fieldColors">{"red":0xff0000,"yellow":0xf58f39,"green":0x65a637}</option>
Works great. Thanks.