How to get the results for a value which is same, but the field name changes?


I have an event that has field names that follows;

file_1_customer : 123456789 

file_2_customer : 34569876893

file_3_customer : 87974849747

file_4_customer : 473257792237

In this I'm looking for only this value (87974849747) and this value is constant it doesn't change. But the field name changes. 

Example: Today the (87974849747) value comes in field file_3_customer, but tomorrow it may comes in file_1_customer and day after tomorrow it may comes in file_4_customer. Every day the field name changes but not the value. The value is same.

How can I get the only field name and field value for (87974849747) respective with the changes?


Labels (1)
0 Karma


This might help.  It filters on the customer number then narrows the search to one of the four fields.


index=foo "87974849747"
| where (file_1_customer=87974849747 OR file_2_customer=87974849747 OR file_3_customer=87974849747 OR file_4_customer=87974849747)
| eval customer_field=case(file_1_customer=87974849747, "file_1_customer",
file_2_customer=87974849747, "file_2_customer", file_3_customer=87974849747, "file_3_customer", file_4_customer=87974849747, "file_4_customer", 1=1, "error")
| table customer_field


It's a bit ugly and perhaps not what you're looking for, but it should get the conversation going.

If this reply helps you, Karma would be appreciated.
0 Karma


I tried, it's not working. The event looks like below. The Account number's & ID's will be same. The report will be generated every day, one day the account Id will be shown in Account_0 and other day it will be shown in Account_2 or Account_1, etc. How can I get details for only one particular Account? whether it is in Account_0 or Account_1 or Accoun_2 it doesn't matter.



"calDate" : "2021-08-10",

"calTime" : "00:30:16.40",

"calType" : "T",

"urlTitle" : "URL",

"actualUrl" : "report-delivery",

"calStatus" : "0",

"duration" : "2200",

"kvpMap" :"file_0_deliveryChannel" : "***",

"file_0_dropStatus" : "UPLOAD",

"file_0_fileName" : "detail_report",

"file_0_AccountID" : "0123456789",

"file_0_AccountNumber" : "9876543210",

"file_0_referenceUrl" : "detail_report",

"file_0_tenant" : "SPLUNK",

"file_1_deliveryChannel" : "***",

"file_1_dropStatus" : "UPLOAD",

"file_1_fileName" : "detail_report",

"file_1_AccountID" : "00000111111",

"file_1_payPalAccountNumber" : "8989898989",

"file_1_tenant" : "SPLUNK",

0 Karma


First, I noticed a copy-paste error in my reply so please try it again.

Are the fields extracted?  If not, then the query won't work.  Fields can be extracted by the query, automatically at search-time, or at index-time.

A mock-up of the desired output would be helpful.

If this reply helps you, Karma would be appreciated.
0 Karma


Depending on what your actual event look like, you might be able to find the field name like this:

| rex "\s(?<field>[^:\s]+)\s:\s87974849747\s"
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...