How to set FIELDA to value(FIELDB) inline search... replacing case statement

[snoobzilla]

Wasn't sure how title this one. We are to do feed multiple different events into same dashboards interfaces built in sideview. I would like to be able to stream multiple types of events into same interface where I lookup which field should be displayed in DISPLAY_FIELD....

Currently...

search (returning events with a TYPE field which dictates which field DISPLAY_FIELD should be set to... )
| eval DISPLAY_FIELD=case(TYPE=TYPE1, DISPLAY_FIELD1, TYPE=TYPE2, DISPLAY_FIELD2, , TYPE=TYPE3, DISPLAY_FIELD3,...)

Would like to figure out how to replace case with a lookup

search ....
| lookup DISPLAY_FIELD_NAMES TYPE OUTPUT DISPLAY_FIELD_NAME
| eval DISPLAY_FIELD=value(DISPLAY_FIELD_NAME)

After reviewing solution offered, thinking this may make sense as a custom search command in python or javascript... I am not a formal programmer so haven't worked in those languages or build custom commands before. Thoughts and/or code examples welcome.

[snoobzilla]

Thinking this may make sense as a custom search command in python or javascript... I am not a formal programmer so haven't worked in those languages or build custom commands before. Thoughts?

[somesoni2]

Give this a try

Your base search | stats count by TYPE | lookup DISPLAY_FIELD_NAMES TYPE OUTPUT DISPLAY_FIELD_NAME
| map maxsearches=100 search="Your base search (replace all double quotes with \doublequote| eval DISPLAY_FIELD=$DISPLAY_FIELD_NAME$"

A sample runanywhere example for this is below:

| gentimes start=-1 | eval DisplayField="Last" | map maxsearches=100 search="| gentimes start=-1 | eval First=\"Somesh\" | table First | eval Last=\"Soni\" | eval Result=$DisplayField$"

Edit | eval DisplayField="Last" value to "First" to see the change in Result field value.

[snoobzilla]

Will give it a try thanks!

[somesoni2]

How may rows do you have in your base search. There is one method this might work but its not efficient in terms of performance, so no of rows matters.

[snoobzilla]

Right now we are heading at 1000 for one interface but I would like to up that... say 10000 max. Thanks!