Splunk Enterprise

Replace values in query

leandromatperei
Path Finder

Guys.

I have the following query below that shows the results by hosts, it works very well. However, I need to replace the host with another value, example below

 

index=text (host=host1 OR host=host2 OR host=host3 OR host=host4)) 
 timechart span=1h count by host
host1 = Valuea
host2 = Valueb
host3 = Valuec
host4= Valued

 

What is the best way to make this replacement using eval or a lookup?

Att.

Labels (2)
Tags (2)
0 Karma

manjunathmeti
Champion

hi @leandromatperei,
You can use eval command with case function.

| eval host=case(host="host1", "Valuea", host="host1", "Valueb", host="host1","Valuec", host="host1", "Valued") 

 

If this reply helps you, an upvote/like would be appreciated.

0 Karma