How do I implement multiple rename commands based on user input

actionabledata — Sun, 25 Jul 2021 02:49:05 GMT

I have a single algorithm with 2 methods. Each method produces the same type of data but with different fields names to keep them separated. The dashboard charts depend on which method the user selects in a menu.

Essentially I create interim results for both methods but desire to change the names to the field names used in the subsequent code.

[Q] What is a more efficient method of performing the "Big Switch" in the run anywhere code below?

| makeresults 5 | rename comment AS "-----------------------------------------------------------------" | rename comment AS "User Menu Selection" | eval switch="A" | rename comment AS "-----------------------------------------------------------------" | rename comment AS "Algorithm element2" | eval calcMethod1_field1="1" | eval calcMethod1_field2=2 | eval calcMethod1_field3=3 | eval calcMethod1_field4=4 | eval calcMethod1_field5=5 | rename comment AS "-----------------------------------------------------------------" | rename comment AS "Algorithm element2" | eval calcMethod2_field1="1sub" | eval calcMethod2_field2="2sub" | eval calcMethod2_field3="3sub" | eval calcMethod2_field4="4sub" | eval calcMethod2_field5="5sub" | rename comment AS "-----------------------------------------------------------------" | rename comment AS " Big Switch " | rename comment AS "-----------------------------------------------------------------" | rename comment AS "This is the big switch before entering a stats command" | rename comment AS "Intent is to rename several fields depending on switch value" | eval fieldnameforstats_field1=case(switch=="A",calcMethod1_field1,switch=="B",calcMethod2_field1) | eval fieldnameforstats_field2=case(switch=="A",calcMethod1_field2,switch=="B",calcMethod2_field2) | eval fieldnameforstats_field3=case(switch=="A",calcMethod1_field3,switch=="B",calcMethod2_field3) | eval fieldnameforstats_field4=case(switch=="A",calcMethod1_field4,switch=="B",calcMethod2_field4) | eval fieldnameforstats_field5=case(switch=="A",calcMethod1_field5,switch=="B",calcMethod2_field5) | fields - _time | table fieldnameforstats_field*

topic How do I implement multiple rename commands based on user input in Splunk Search

How do I implement multiple rename commands based on user input