Reporting

How to replace number field values with a string?

yvassilyeva
Path Finder

Hi! I am trying to rename field values from a number to a string like this:

I calculated whether the project has been past due or not by subtracting today's date minus project ask date: 

| eval "Past/Future"=round(abs((relative_time(now(), "@d")-relative_time(strptime(project_ask_date,"%Y-%m-%d %H:%M:%S"), "@d"))/86400),0) 

Now i want to rename the field values: 

If the number is >0 then it is past due, otherwise the project's due date is in the future. 

Thank you!

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

To be picky, rename changes the name of a field rather than change the value itself.  To change a value you can use eval.  BTW, I used a different field name because slashes are not valid field name characters.

... | eval PastFuture = if(PastFuture>=0, "Past Due", "Future")

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

To be picky, rename changes the name of a field rather than change the value itself.  To change a value you can use eval.  BTW, I used a different field name because slashes are not valid field name characters.

... | eval PastFuture = if(PastFuture>=0, "Past Due", "Future")

 

---
If this reply helps you, Karma would be appreciated.

yvassilyeva
Path Finder

Thank you! 

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...