from the table output, i want to rename row values for few fields, say for eg:
I want the result to look like below:
Basically, I have a list for mapping, Any letter begins with A to be renamed as Apple, and the ones with D to be renamed as Drumstick, and so on.
Can someone please help me? I am quite new to Splunk.
Thanks in advance.
Here's one way to do that. There may be others, perhaps including one that uses a lookup table.
| eval Column2 = case(Column2=="AAA", "Apple", Column2=="C", "Carrot", Column2=="D" OR Column2=="DDD", "Drumstick", Column2=="MMM", "Mango", 1==1, Column2)
View solution in original post
This worked perfectly, thank you.
Can you also let me know if i can categorize all the fruits in Column 2 and add a column with the total number of fruits.
I expect the result to be like this:
Your help is much appreciated.