I have this search:
index=nitro_iPad | rex "iPad-ip(?<storeNum>[^-]+)" | rex "iOS(?<osversion>[^-]+)" | table osversion storeNum | dedup storeNum
Here is an image of my results:
I want to alter my results so when it says ####j it would be ####skate but for all of the letters present for example 1529k would turn into 1529candy.
I figure a rename function would work but I tried to no avail I am guessing I just did it incorrectly.
Also works but the problem I am having here is with situations like 1502aa which would be 1502marshmallow but 1407a would be 1407crush instead 1502 would show up like this 1502marshmallowcrush.
try to add to your search something like this (I inserted in case function only two options, but you can insert other):
| eval storeNum=substr(storeNum,1,4)+case(substr(storeNum,5)="j","_skate",substr(storeNum,5)="k","_candy")
Give this a try
index=nitro_iPad | rex "iPad-ip(?<storeNum>[^-]+)" | rex "iOS(?<osversion>[^-]+)" | table osversion storeNum | eval storeNum=case(match(storeNum,"^\d+j$"),replace(storeNum,"^(\d+)j","\1_skate"),match(storeNum,"^\d+w+$"), replace(storeNum,"^(\d+)\w+$","\1_candy"),true(),storeNum) | dedup storeNum