I have this search:
index=nitro_iPad | rex "iPad-ip(?<storeNum>[^-]+)" | rex "iOS(?<osversion>[^-]+)" | table osversion storeNum | dedup storeNum
Here is an image of my results:
I want to alter my results so when it says ####j it would be ####_skate but for all of the letters present for example 1529k would turn into 1529_candy.
I figure a rename function would work but I tried to no avail I am guessing I just did it incorrectly.
Give this a try
index=nitro_iPad | rex "iPad-ip(?<storeNum>[^-]+)" | rex "iOS(?<osversion>[^-]+)" | table osversion storeNum | eval storeNum=case(match(storeNum,"^\d+j$"),replace(storeNum,"^(\d+)j","\1_skate"),match(storeNum,"^\d+w+$"), replace(storeNum,"^(\d+)\w+$","\1_candy"),true(),storeNum) | dedup storeNum
try to add to your search something like this (I inserted in case function only two options, but you can insert other):
| eval storeNum=substr(storeNum,1,4)+case(substr(storeNum,5)="j","_skate",substr(storeNum,5)="k","_candy")
Also works but the problem I am having here is with situations like 1502aa which would be 1502_marshmallow but 1407a would be 1407_crush instead 1502 would show up like this 1502_marshmallow_crush.