Hi! I am trying to rename field values from a number to a string like this:
I calculated whether the project has been past due or not by subtracting today's date minus project ask date:
| eval "Past/Future"=round(abs((relative_time(now(), "@d")-relative_time(strptime(project_ask_date,"%Y-%m-%d %H:%M:%S"), "@d"))/86400),0)
Now i want to rename the field values:
If the number is >0 then it is past due, otherwise the project's due date is in the future.
Thank you!
To be picky, rename changes the name of a field rather than change the value itself. To change a value you can use eval. BTW, I used a different field name because slashes are not valid field name characters.
... | eval PastFuture = if(PastFuture>=0, "Past Due", "Future")
To be picky, rename changes the name of a field rather than change the value itself. To change a value you can use eval. BTW, I used a different field name because slashes are not valid field name characters.
... | eval PastFuture = if(PastFuture>=0, "Past Due", "Future")
Thank you!