i want case command to match case where abc = hhh and after word should be same as present as it is
abc
abc
efg
ffh
[Updated Answer]
With exact match and run anywhere search query
Ok then you need the following to be added to your existing search
| makeresults
| eval type="abc,xyzabc,abcdef,xyzabcdef"
| makemv type delim=","
| mvexpand type
| replace "abc" with "123" in type
Or else
| makeresults
| eval type="abc,xyzabc,abcdef,xyzabcdef"
| makemv type delim=","
| mvexpand type
| eval type=replace(type,"^abc$","123")
[Updated Answer]
With exact match and run anywhere search query
Ok then you need the following to be added to your existing search
| makeresults
| eval type="abc,xyzabc,abcdef,xyzabcdef"
| makemv type delim=","
| mvexpand type
| replace "abc" with "123" in type
Or else
| makeresults
| eval type="abc,xyzabc,abcdef,xyzabcdef"
| makemv type delim=","
| mvexpand type
| eval type=replace(type,"^abc$","123")
| eval type=replace(type,"abc","123")
this condition replaces all the pattern with abc. i want only with exact match "abc".
for example if fields value with "abcefg" it matches and getting replaced with 123
So try this
| eval type=replace(type,"^abc$","123")
You can also try as per previous comment.
| replace "abc" with "123" in type
@premranjithj, your question is not clear, please elaborate and add as much information as possible. What is the data you have (mock/dummy) along with field name? Also what is the query you have tried so far?
i have list of fields
1.abc
2.bbc
3.abc
4.ggh
5.usb
if i a field has value abc its should be replaced with 123. other fields can have the data as it is.
Is the field name abc or the value of the field abc? If it is second case what is the field name?
field name type and value is abc