topic Re: Using field names as variable in column name in Dashboards & Visualizations

Using field names as variable in column name

deepdive100 — Mon, 01 Apr 2024 21:45:21 GMT

I have a timechart that I want a column name to reflect a field name like how a variable or token would be used.

```Example``` |makeresults |eval sample="100" |eval name=if(sample=100,"C",N/A) |timechart max(sample) as $name$ ```Expected Outcome would by a timechart with column named "C"```

Is this possible?

Re: Using field names as variable in column name

danspav — Mon, 01 Apr 2024 22:02:57 GMT

Hi @deepdive100.,

You can create the column name based on what the field "name" is set to using by:

|makeresults |eval sample="100" |eval name=if(sample=100,"C",N/A) |timechart max(sample) by name

This creates a table with columns: _time, C. If the values are less or more than 100, there'll be an additional column "N/A"

If you have a dashboard and you want to pick which column is displayed, you could do something like:

|makeresults |eval sample="100" |eval name=if(sample=100,"$DROPDOWN_TOKEN$",N/A) |timechart max(sample) by name

And set up an input that sets the token $DROPDOWN_TOKEN$.

Re: Using field names as variable in column name

deepdive100 — Tue, 02 Apr 2024 15:23:39 GMT

Hi Thanks. This is almost what I need. I think I need to expand on my requirements a bit more.

```Example``` |makeresults |eval sample="100" |eval perc="45" |eval name=if(sample=100,"C",N/A) |timechart max(sample) as "The Sample yields $name$", avg(perc) as "percentage" ```Expected Outcome would by a timechart with column named "The Sample yields C" and another column titled "percentage"```

Using the BY clause appends that eval'd field in the column name, but not all columns need that field name.
I'd think that the easiest way about doing it would be some type of variable replacement but it seems that the AS clause does not allow that.

Re: Using field names as variable in column name

danspav — Wed, 03 Apr 2024 03:56:31 GMT

I think I understand - try this search to create a table with fields: _time, percentage and one or more columns based on the value calculated each hour:

| gentimes start=-7 | eval sample=random()%100 | eval perc=random()%50 | rename starttime as _time | append[|makeresults | eval sample=100, perc=45| table _time, sample, perc] | timechart span=1d max(sample) as name, avg(perc) as "percentage" ``` Calculate how we name the fields based on the value of: name ``` | eval rename_field_to=if(name=100,"C","N/A") | eval "The Sample Yields {rename_field_to}" = name | fields - rename_field_to, name

This will create three or four columns:

_time = time
percentage = hourly average of the perc field
The Sample Yields C = If the max for that hour was 100
The Sample Yields N/A = If the max for that hour was not 100

If you only want "The Sample Yields C" or nothing, then you can filter out with a | search name="C" after the timechart command.

The main SPL is :

| eval "The Sample Yields {rename_field_to}" = name

That will allow you to name a field using the value of another field.

If you want NA to simply be N/A then you can do a rename:

| rename "The Sample Yields N/A" as "N/A"

Is that closer to what you were after?