topic Re: Take value from one field and return the value in a second field with the same name as that value in Splunk Search

Take value from one field and return the value in a second field with the same name as that value

willial — Mon, 30 Mar 2015 20:10:07 GMT

Sorry for the title. Here's what I'm trying to do:

I have three fields: monthSearch1, monthSearch2, and monthSearch3. These represent a year/month combination. So 201501 = year 2015, month 01.

These have values of, for example: monthSearch1=201501 monthSearch2=201502 monthSearch3=201503

I also have three fields called 201501, 201502, 201503. These have numbers in them like 6 or 8 or 12.

I have even more fields: 201504, 201505, etc. These are all coming from a lookup table. I have things set up so that the monthSearch1,2,3 fields are set by user choices, so I only get the three year/month combos that I want for any user selection.

Basically, I want to use the monthSearch1 field (201501) to find and return the value that's in the 201501 field (and so on), so that I only add up the correct 3 months.

Re: Take value from one field and return the value in a second field with the same name as that value

vganjare — Tue, 31 Mar 2015 11:07:09 GMT

Can you please share the detailed example along with data samples?

Thanks!!

Re: Take value from one field and return the value in a second field with the same name as that value

willial — Tue, 31 Mar 2015 16:37:20 GMT

Here are my statements, starting from the relevant portion:

| eval yr="$form.yr$" | eval quarter="$form.quarter$" | eval yr=if("$form.quarter$"="Q1" OR "$form.quarter$"="Q2",yr-1,yr) | eval monthSearch=if("$form.quarter$"="Q1",'yr'+"07 "+'yr'+"08 "+'yr'+"09 ",monthSearch) | eval monthSearch=if("$form.quarter$"="Q2",'yr'+"10 "+'yr'+"11 "+'yr'+"12 ",monthSearch) | eval monthSearch=if("$form.quarter$"="Q3",'yr'+"01 "+'yr'+"02 "+'yr'+"03 ",monthSearch) | eval monthSearch=if("$form.quarter$"="Q4",'yr'+"04 "+'yr'+"05 "+'yr'+"06 ",monthSearch) | makemv monthSearch | eval monthSearch1=mvindex(monthSearch,0) | eval monthSearch2=mvindex(monthSearch,1) | eval monthSearch3=mvindex(monthSearch,2) | lookup closures "fullName" AS "fullName"

The following is what doesn't work:

| eval month1='monthSearch1' | eval month2='monthSearch2' | eval month3='monthSearch3' |** fillnull value=0 month1 month2 month3

Assume $form.quarter$=Q1 and $form.yr$=2015

The lookup "closures" contains the following info:

fullname,201507,201508,201509,201510,201511,201512
Adam Anderson,12,10,15,,37,11
Bob Briggs,,,4,21,,15
Cam Carson,10,25,31,22,16,1

I want an intermediate table that looks like:

fullName,monthSearch1,monthSearch2,monthSearch3,201507,201508,201509,month1,month2,month3
Adam Anderson,201507,201508,201509,12,10,15,12,10,15

Re: Take value from one field and return the value in a second field with the same name as that value

vganjare — Mon, 27 Apr 2015 12:06:48 GMT

Hi,

Do you want to copy the values from monthSearch1 field to month1 field?

Re: Take value from one field and return the value in a second field with the same name as that value

willial — Mon, 27 Apr 2015 13:54:27 GMT

More convoluted. I want to copy the value from the field whose name is specified in monthSearch1 (field 201507 in the example, yielding 12) to month1.

Re: Take value from one field and return the value in a second field with the same name as that value

vganjare — Tue, 28 Apr 2015 05:36:45 GMT

Can you try using custom search commands? With a small python script, you can achieve this functionality very easily. More details about custom search commands @ http://docs.splunk.com/Documentation/Splunk/6.2.2/AdvancedDev/Searchscripts

Re: Take value from one field and return the value in a second field with the same name as that value

vganjare — Tue, 28 Apr 2015 06:27:07 GMT

Also, can you try solution mentioned @ http://answers.splunk.com/answers/103700/how-do-i-create-a-field-whose-name-is-the-value-of-another-field-like-backticks-or-eval-in-other-languages.html

Re: Take value from one field and return the value in a second field with the same name as that value

willial — Tue, 28 Apr 2015 14:00:00 GMT

The solution there is for creating a new field. I'm trying to reference an existing field.

Re: Take value from one field and return the value in a second field with the same name as that value

vganjare — Wed, 29 Apr 2015 06:36:33 GMT

Hi,

You can try using custom search command. http://docs.splunk.com/Documentation/Splunk/6.2.2/AdvancedDev/Searchscripts

You can copy over the field values in desired field by using string token.

Thanks!!