Hi Everyone,
I am using below query:
index=abc ns=blazegateway|stats count by app_name|eval f1="hg"
I am getting result as :
app_name count f1
abc 1 hg
bcd 2 hg
My requirement is for my column f1 I am getting hg in both rows I want some other name in 2nd row
What changes I should do in my query
Depending on how you determine what value should go in f1, you could use a case function, e.g.
| eval f1=case(app_name="abc","hg")
| eval f2=case(app_name="bcd","xy")
Depending on how you determine what value should go in f1, you could use a case function, e.g.
| eval f1=case(app_name="abc","hg")
| eval f2=case(app_name="bcd","xy")