topic Re: Rename fields based on Token value in Splunk Search

Rename fields based on Token value

mcaulsc — Thu, 30 Sep 2021 09:23:15 GMT

Hi,

I have some data which spans multiple systems example below:

"system" "app" "fld1" "fld2" "fld3"

sys1 appA 1 0 0

sys1 appA 0 0 0

sys1 appB 0 1

What I'm trying to do is create a generic dashboard so I would need to rename the fields based on the "app" value. So something similar to:

when app=="appA" rename "fld1" as "appAfld1", rename "fld2" as "appAfld2"

when app=="appB" rename "fld1" as "appBfld1"

Then in a table only show the renamed fields, so a conditional table statement again based on the "app" value.

Any ideas on how/if that can be achieved? Alternately I just create separate dashboards but a lot of repetition in that so I suspect there is a way to do it.

Thanks in advance for any ideas.

Re: Rename fields based on Token value

ITWhisperer — Thu, 30 Sep 2021 10:00:04 GMT

| foreach fld* [| eval {app}<<FIELD>> = <<FIELD>>]

Re: Rename fields based on Token value

mcaulsc — Thu, 30 Sep 2021 13:08:07 GMT

sorry, will have to walk me through the :
[| eval {app}<<FIELD>> = <<FIELD>>]

what is that doing and how would that handle multiple values for app?

Re: Rename fields based on Token value

ITWhisperer — Thu, 30 Sep 2021 20:12:00 GMT

The braces around the app uses the value of the field as part of the field name and then the name of the field from the foreach <<FIELD>> is add so {app}<<FIELD>> = <<FIELD>> becomes appAfld1 = fld1 which is what you were after.

Re: Rename fields based on Token value

mcaulsc — Fri, 01 Oct 2021 07:53:54 GMT

ah, I see now, thanks for the explanation, I got that working and that will be useful.

My example was a bit too literal I think where I masked names. What I'm actually after is a complete rename so:
when app=="appA" rename "fld1" as "newname1", rename "fld2" as "newname2", rename "fld3" as "newname11"

Re: Rename fields based on Token value

mcaulsc — Fri, 01 Oct 2021 08:07:40 GMT

so what I really want is something equivalent to IF .... THEN DO

If app =app1 then Do
rename fld1 as newname1
rename fld2 as newname2
rename field3 as newname11
End
If app =app2 then Do
rename fld1 as newnameA
rename fld2 as newnameB
rename field3 as newnameYY
End

Hopefully that makes more sense.

Re: Rename fields based on Token value

ITWhisperer — Fri, 01 Oct 2021 08:18:38 GMT

Flip it the other way around

| eval newname1=case(app="app1","newname1",app="app2","newnameA") | eval {newname1}=fld1 | eval newname2=case(app="app1","newname2",app="app2","newnameB") | eval {newname2}=fld2 etc.

Re: Rename fields based on Token value

mcaulsc — Fri, 01 Oct 2021 09:14:45 GMT

That's it, excellent and I can pull them into a table etc with a generic.
Thanks for the solution and also the explanations.