hi
I have a column with the following name
transactionId: N/A
the value after : it can take on more values
transactionId: start
how can I rename it so that it always takes the value transactionId ?
Thanks for your help 🙂
Simone
Do you mean something like this?
| makeresults
| eval transactionid="start"
| eval {transactionid}=transactionid
hi @ITWhisperer
start is the name that the column takes, the field can be called
"transactionId: N/A" OR "transactionId: start"
I would like to rename it "transactionId" depending on the name it takes
simone
| makeresults
| eval transactionid=split("transactionid: start,transactionid: N/A",",")
| mvexpand transactionid
| streamstats count as row
| eval {transactionid}=mvindex(split("AB",""),row%2)
| fields - transactionid _time row
| foreach "transactionid: *"
[| eval transactionid=coalesce(transactionid,'<<FIELD>>')]
You can't have more than one field with the same name but you can eval a field more than once