Splunk Enterprise

Replace values in query

Path Finder


I have the following query below that shows the results by hosts, it works very well. However, I need to replace the host with another value, example below


index=text (host=host1 OR host=host2 OR host=host3 OR host=host4)) 
 timechart span=1h count by host
host1 = Valuea
host2 = Valueb
host3 = Valuec
host4= Valued


What is the best way to make this replacement using eval or a lookup?


Labels (2)
Tags (2)
0 Karma


hi @leandromatperei,
You can use eval command with case function.

| eval host=case(host="host1", "Valuea", host="host1", "Valueb", host="host1","Valuec", host="host1", "Valued") 


If this reply helps you, an upvote/like would be appreciated.

0 Karma