All Apps and Add-ons

How to set FIELDA to value(FIELDB) inline search... replacing case statement

Builder

Wasn't sure how title this one. We are to do feed multiple different events into same dashboards interfaces built in sideview. I would like to be able to stream multiple types of events into same interface where I lookup which field should be displayed in DISPLAY_FIELD....

Currently...

search (returning events with a TYPE field which dictates which field DISPLAY_FIELD should be set to... )
| eval DISPLAY_FIELD=case(TYPE=TYPE1, DISPLAY_FIELD1, TYPE=TYPE2, DISPLAY_FIELD2, , TYPE=TYPE3, DISPLAY_FIELD3,...)

Would like to figure out how to replace case with a lookup

search ....
| lookup DISPLAY_FIELD_NAMES TYPE OUTPUT DISPLAY_FIELD_NAME
| eval DISPLAY_FIELD=value(DISPLAY_FIELD_NAME)

After reviewing solution offered, thinking this may make sense as a custom search command in python or javascript... I am not a formal programmer so haven't worked in those languages or build custom commands before. Thoughts and/or code examples welcome.

0 Karma

Builder

Thinking this may make sense as a custom search command in python or javascript... I am not a formal programmer so haven't worked in those languages or build custom commands before. Thoughts?

0 Karma

SplunkTrust
SplunkTrust

Give this a try

Your base search | stats count by TYPE | lookup DISPLAY_FIELD_NAMES TYPE OUTPUT DISPLAY_FIELD_NAME
| map maxsearches=100 search="Your base search (replace all double quotes with \doublequote| eval DISPLAY_FIELD=$DISPLAY_FIELD_NAME$"

A sample runanywhere example for this is below:

| gentimes start=-1 | eval DisplayField="Last" | map maxsearches=100 search="| gentimes start=-1 | eval First=\"Somesh\" | table First | eval Last=\"Soni\" | eval Result=$DisplayField$"

Edit | eval DisplayField="Last" value to "First" to see the change in Result field value.

0 Karma

Builder

Will give it a try thanks!

0 Karma

SplunkTrust
SplunkTrust

How may rows do you have in your base search. There is one method this might work but its not efficient in terms of performance, so no of rows matters.

0 Karma

Builder

Right now we are heading at 1000 for one interface but I would like to up that... say 10000 max. Thanks!

0 Karma