Can we categorize the into fields based on the value of the field?

[vrmandadi]

Hello,

I have the below field with values

Source

abc_hd
xyz_hd
ppp
sqr_sd
aaa_sd

I want to create a new field called version with values as SD and HD,all the values with the _HD are HD and the other is counted as SD LIKE BELOW

Version
SD-3
hd-2

[elliotproebstel]

For this, I'd use a case statement and evaluate the field value with like to find the matching values and then use eventstats to count the matches before appending the type and count to create the desired Version field:

[ base search ] | eval type=case(like(Source, "%_hd"), "HD", like(Source, "%_sd"), "SD") | eventstats count BY type | eval Version=type."-".count | fields - type count

[vrmandadi]

hello elliotproebstel,

the SD ones some have _SD and some dont ,I tried your query but this not show any results

[elliotproebstel]

Ah, yes, I missed that nuance. Sorry! Try this:

 [ base search ] | eval type=if(like(Source, "%_hd"), "HD", "SD") | eventstats count BY type | eval Version=type."-".count | fields - type count

That should assign HD as the type for events containing _hd and assign SD as the type for all others.

[vrmandadi]

Thank you ,I tried this | eval Version=if(match(Source,"_hd"),"HD","SD")
| stats count by Version

I was actually using wild character and it was throwing error

[gcusello]

Hi vrmandadi
try something like this

your_search
| rex field=source "(?<HD>hd|HD)$"
| eval Version=if(HD=*,"HD","SD")
| stats count BY Version

Bye.
Giuseppe

[vrmandadi]

Hi cudello,
I am getting the below error

Error in 'eval' command: The expression is malformed. An unexpected character is reached at '*,"HD","SD")'.

[gcusello]

try

your_search
 | rex field=source "(?<HD>hd|HD)$"
 | eval Version=if(HD="*","HD","SD")
 | stats count BY Version

Bye.
Giuseppe

[somesoni2]

You can try like this (function coalesce is setting sd as default value of no version if found on Source)

your search with field Source
| eval Version=coalesce(mvindex(split(Source,"_"),-1),"sd")
| stats count by Version

[vrmandadi]

Hi somesoni2 it only extracted HD

[somesoni2]

Can you post some sample (if possible real value with sensitive data replaced with dummy char, try to keep the punctuations) where it failed to extract? It assumes that last segment after underscore is version in the values of field Source.

[somesoni2]

Also give this a try

your search with field Source
 | eval Version=if(match(Source,"_hd"),"HD","SD")
 | stats count by Version

[vrmandadi]

This one worked ,I was using this one but I was using wildcharater * which was throwing me an error

Thanks a lot