Custom text - Table

[mahesh27]

index=testindex source=application.logs
|rex "ErrorCode\:\[?<Error_Code>\d+]"
|search Error_Code IN(200, 500, 400, 505, 500)
|stats count by Error_Code
|Where count > 5

output:

Error_Code	count
200	20
500	100
400	40
505	45
500	32

Instead of Errorcodes we want to display a custom text  as shown below.
How can we do this??

Expected output:

Error_Code	count
Application received with errorcode 200	20
Application received with errorcode 500	100
Application received with errorcode 400	40
Application received with errorcode 505	45
Application received with errorcode 500	32

[mahesh27]

hi @richgalloway , Even i tried with eval command but it did not work.
But i tried as per  your query it worked, thank you.

[richgalloway]

I don't understand the reply.  Did my answer work or not?  If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

[richgalloway · Accepted solution]

Use the eval command to replace the Error_Code value with the desired text.

index=testindex source=application.logs
| rex "ErrorCode\:\[?<Error_Code>\d+]"
| search Error_Code IN (200, 500, 400, 505)
| stats count by Error_Code
| eval Error_Code = "Application received with errorcode " + Error_Code
| where count > 5