Dashboards & Visualizations
Highlighted

How to change name of results dynamically

Contributor

I have this search:

 index=nitro_iPad | rex "iPad-ip(?<storeNum>[^-]+)"  | rex "iOS(?<osversion>[^-]+)"  | table osversion storeNum | dedup storeNum

Here is an image of my results:
alt text

I want to alter my results so when it says ####j it would be ####skate but for all of the letters present for example 1529k would turn into 1529candy.

I figure a rename function would work but I tried to no avail I am guessing I just did it incorrectly.

Thank you!

0 Karma
Highlighted

Re: How to change name of results dynamically

Esteemed Legend

Like this:

... | rex field=storeNum mode=sed "s/\D+$/_candy/"
0 Karma
Highlighted

Re: How to change name of results dynamically

Contributor

Also works but the problem I am having here is with situations like 1502aa which would be 1502marshmallow but 1407a would be 1407crush instead 1502 would show up like this 1502marshmallowcrush.

0 Karma
Highlighted

Re: How to change name of results dynamically

Esteemed Legend

Then you chain them up like this:

 ... | rex field=storeNum mode=sed "s/k$/_candy/ s/aa$/_marshmallow/ s/a$/_crush/"
0 Karma
Highlighted

Re: How to change name of results dynamically

Contributor

I am getting a weird search is waiting for input when I start to chain

0 Karma
Highlighted

Re: How to change name of results dynamically

Esteemed Legend

Make sure that you are doing the tokening correctly. Download this app and check out the examples:

https://splunkbase.splunk.com/app/1603/

Check out the code for "Token Customization" examples.

0 Karma
Highlighted

Re: How to change name of results dynamically

Legend

Hi JoshuaJohn,
try to add to your search something like this (I inserted in case function only two options, but you can insert other):

| eval storeNum=substr(storeNum,1,4)+case(substr(storeNum,5)="j","_skate",substr(storeNum,5)="k","_candy")

Bye.
Giuseppe

0 Karma
Highlighted

Re: How to change name of results dynamically

Contributor

This works but it will completely ignore ones without a letter behind the name like 0126

0 Karma
Highlighted

Re: How to change name of results dynamically

SplunkTrust
SplunkTrust

Give this a try

index=nitro_iPad | rex "iPad-ip(?<storeNum>[^-]+)"  | rex "iOS(?<osversion>[^-]+)"  | table osversion storeNum | eval storeNum=case(match(storeNum,"^\d+j$"),replace(storeNum,"^(\d+)j","\1_skate"),match(storeNum,"^\d+w+$"), replace(storeNum,"^(\d+)\w+$","\1_candy"),true(),storeNum) | dedup storeNum
0 Karma