Can I rename a field conditionally?

[HMTODD]

I have a field named severity. It has three possible values, 1,2, or 3. I want to rename this field to red if the field value is 1. I want to rename the field name to yellow if the value is 2. And I want to name the field to red if the value is 3. How can I renamed a field based on a condition?

[niketn]

@HMTODD, can you add your query with the final transforming command? Also the data as displayed by current query? Are there any other fields besides severity that you are interested in and are being currently displayed in the final output?
Do you really want to name the field as red if the value is either 1 or 3?

[MuS · Accepted solution]

Hi HMTODD,

try this run everywhere search to see an example how it can be done:

| gentimes start=-1 
| eval severity ="1 2 3" 
| makemv severity 
| mvexpand severity
| rename comment AS "Here starts the real code"
| eval red=case(severity="1", 1, severity="3", 3, 1=1, null()), yellow=case(severity="2", 2, 1=1, null())

The first 5 lines just create fake events and the eval created a field called red or yellow based on the severity field. You can process the results further and remove the severity field with table or fields if it's not needed. You can also another eval to get a field called green if needed.

Hope this helps ...

cheers, MuS

[HMTODD]

Thanks. The big win for me was the case command. Here is a bit of detail on my problem and how it has been solved with your help.

I wanted to create a single color pie chart that would be red OR yellow OR green depending on the value of the field named severity. The search results that I am working with is a single field, severity, and the value, either a 1, or 2, or 3.

I solved this with the following.
eval color=case(severity="1","red",severity="2","yellow",severity="3","green") | chart count by color

combined with this customer pie chart option

   <option name="charting.fieldColors">{"red":0xff0000,"yellow":0xf58f39,"green":0x65a637}</option>

Works great. Thanks.