How to get two different field names

[aditsss]

Hi Everyone,

I am using below query:

index=abc  ns=blazegateway|stats count by app_name|eval f1="hg"

I am getting result as :

app_name                     count                  f1

abc                                       1                          hg

bcd                                          2                         hg

My requirement is for my column f1 I am getting hg in both rows I want some other name in 2nd row

What changes I should do in my query

[aditsss]

@ITWhisperer 

Thank you so much

[ITWhisperer · Accepted solution]

Depending on how you determine what value should go in f1, you could use a case function, e.g.

| eval f1=case(app_name="abc","hg")
| eval f2=case(app_name="bcd","xy")