Dashboards & Visualizations

How to get two different field names

aditsss
Motivator

Hi Everyone,

I am using below query:

index=abc  ns=blazegateway|stats count by app_name|eval f1="hg"

I am getting result as :

app_name                     count                  f1

abc                                       1                          hg

bcd                                          2                         hg

My requirement is for my column f1 I am getting hg in both rows I want some other name in 2nd row

What changes I should do in my query

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Depending on how you determine what value should go in f1, you could use a case function, e.g.

 

| eval f1=case(app_name="abc","hg")
| eval f2=case(app_name="bcd","xy")

 

View solution in original post

aditsss
Motivator

@ITWhisperer 

 

Thank you so much

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Depending on how you determine what value should go in f1, you could use a case function, e.g.

 

| eval f1=case(app_name="abc","hg")
| eval f2=case(app_name="bcd","xy")

 

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...