topic Re: Extract first characters of field if in Dashboards & Visualizations

Extract first characters of field if

marco_massari11 — Mon, 30 Nov 2020 09:50:20 GMT

Hi,

I need to extract first 7 characters of a network device name, like this:

| eval site=substr(Device,1,7) to identify the site

But if the the first 7 characters are equals to site=mysite1 I need also the last 4 charatcters of the device name:

| substr(Device, -4)

If the first 7 characters are !=mysite1 I don't need the last 4

How can I merge those conditions in a unique field? beacause at the end of the query I have :

| chart count(Interface) as Interfaces by site so I need only one eval site field

Thanks in advance!

Re: Extract first characters of field if

493669 — Mon, 30 Nov 2020 10:09:23 GMT

@marco_massari11 Try below

| eval site=case(substr(Device,1,7)=="mysite1",substr(Device, -4),1=1,substr(Device,1,7) )

Re: Extract first characters of field if

marco_massari11 — Mon, 30 Nov 2020 10:39:05 GMT

If the first 7 characters are equal to mysite1, the query takes only the last 4 characters, but I need the first 7 and the last 4. So the solution is:

| eval site=case(substr(Device,1,7)=="mysite1",substr(Device1 , 7) + substr(Device, -4),1=1,substr(Device,1,7) )

Thanksss!