A standard eval if match example is below.
Any ViewUrl value which starts with /company/.* has the entire string replaced with only "/company/*"
my search | eval ViewUrl=if(match(ViewUrl,"/company/.*"), "/company/*", ViewUrl)
Is it possible to do this dynamically from a list of values?
For example instead of only having the single value of "/company/*" I have around 500 values in a lookup or populated from a sub-search.
I could write this out manually as below, however this is impractical.
my search | eval ViewUrl=if(match(ViewUrl,"value1"),"value1",ViewUrl)
| eval ViewUrl=if(match(ViewUrl,"value2"),"value2",ViewUrl)
| eval ViewUrl=if(match(ViewUrl,"value3"),"value3",ViewUrl)
| eval ViewUrl=if(match(ViewUrl,"valuen"),"valuen",ViewUrl)
Is there a way of using a loop or the for each command to achieve the above in a few lines instead of hundreds?
Thanks,
Dan
... View more