I have created a dashboard based on various search criteria. I would like to add a column (Say A) to it,
based on one of the output column(Say B) which I got after the search.
Here Column B value must be matched against the information that I have and need to hard code it.
Can anyone suggest how can I achieve this?
ABC ONE DEF TWO
ONE RED TWO Black
ABC ONE RED DEF TWO Black
if you have few values, at the end of your search you can add an eval command
your_search | table field1 field2 | eval field3=case(field2="ONE","RED",field2="TWO","Black")
if instead you have many values, you have to create a lookup with all your values (e.g. "my_lookup.csv"
field2,field2 ONE,RED TWO,Black ...,...
and then use the lookup command
your_search | lookup my_lookup.csv field2 OUTPUT field3 | table field1 field2 field3
Thanks Giuseppe, it worked for me. but there is one other thing here, I need to populate the values as "NA" if the value is not present in my output column.
see the fillnull command:
... | fillnull value="NA" field3
otherwise, if you use the eval command, you can insert a condition for empty values.
| eval field3=if(isnull(field3),"NA","field3)
if you're satisfied of this answer, please accept and/or upvote it.
You can use lookup like:
<query to get existing output> | lookup color.csv NUM OUTPUT COLOR
color.csv NUM,COLOR ONE,RED TWO,Black existing output SOME_FIELD,NUM ABC,ONE DEF,TWO
Notice that your existing result has column name NUM that need to be match with NUM column in lookup.
Hope this helps!!!
Hi @ramyaashok ,
Did you have a chance to check out some answers? If it worked, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help you.
Thanks for posting!