How to get the results for a value which is same, but the field name changes?

[Splunker1247]

I have an event that has field names that follows;

file_1_customer : 123456789 

file_2_customer : 34569876893

file_3_customer : 87974849747

file_4_customer : 473257792237

In this I'm looking for only this value (87974849747) and this value is constant it doesn't change. But the field name changes. 

Example: Today the (87974849747) value comes in field file_3_customer, but tomorrow it may comes in file_1_customer and day after tomorrow it may comes in file_4_customer. Every day the field name changes but not the value. The value is same.

How can I get the only field name and field value for (87974849747) respective with the changes?

[richgalloway]

This might help.  It filters on the customer number then narrows the search to one of the four fields.

index=foo "87974849747"
| where (file_1_customer=87974849747 OR file_2_customer=87974849747 OR file_3_customer=87974849747 OR file_4_customer=87974849747)
| eval customer_field=case(file_1_customer=87974849747, "file_1_customer",
file_2_customer=87974849747, "file_2_customer", file_3_customer=87974849747, "file_3_customer", file_4_customer=87974849747, "file_4_customer", 1=1, "error")
| table customer_field

It's a bit ugly and perhaps not what you're looking for, but it should get the conversation going.

[Splunker1247]

I tried, it's not working. The event looks like below. The Account number's & ID's will be same. The report will be generated every day, one day the account Id will be shown in Account_0 and other day it will be shown in Account_2 or Account_1, etc. How can I get details for only one particular Account? whether it is in Account_0 or Account_1 or Accoun_2 it doesn't matter.

----------------------------------------------

"calDate" : "2021-08-10",

"calTime" : "00:30:16.40",

"calType" : "T",

"urlTitle" : "URL",

"actualUrl" : "report-delivery",

"calStatus" : "0",

"duration" : "2200",

"kvpMap" : { "file_0_deliveryChannel" : "***",

"file_0_dropStatus" : "UPLOAD",

"file_0_fileName" : "detail_report",

"file_0_AccountID" : "0123456789",

"file_0_AccountNumber" : "9876543210",

"file_0_referenceUrl" : "detail_report",

"file_0_tenant" : "SPLUNK",

"file_1_deliveryChannel" : "***",

"file_1_dropStatus" : "UPLOAD",

"file_1_fileName" : "detail_report",

"file_1_AccountID" : "00000111111",

"file_1_payPalAccountNumber" : "8989898989",

"file_1_tenant" : "SPLUNK",

[richgalloway]

First, I noticed a copy-paste error in my reply so please try it again.

Are the fields extracted?  If not, then the query won't work.  Fields can be extracted by the query, automatically at search-time, or at index-time.

A mock-up of the desired output would be helpful.

[ITWhisperer]

Depending on what your actual event look like, you might be able to find the field name like this:

| rex "\s(?<field>[^:\s]+)\s:\s87974849747\s"