Change a value in the output field.

[jerinvarghese]

Hi all,

I need help in changing an output that getting from below search to be changed.

index=itsm
| stats count by Class_Type
| sort - count

Output that results is: 

Class_Type	count
NodeDown Trap	2129
Cisco LWAPP AP Trap	766

Can i change the output and reflect another name in the section.

Like i want "Cisco LWAPP AP Trap" to be displayed as "CISCO AP DOWN"

is that possible.

[renjith_nair · Accepted solution]

@jerinvarghese,

Yes, there are different ways of doing it and depends on how many values you want to change. If there are only few, you could use simple eval

|eval Class_Type=case(Class_Type="Cisco LWAPP AP Trap","CISCO AP DOWN",1=1,Class_Type)

You can add more conditions in the case

[renjith_nair]

@jerinvarghese,

Glad it worked. Appreciate an upvote (karma) and you may close the question by accepting as a solution 🙂