I have a raw where each event looks like this (simplified for this exampel):
{"time": "2022-01-20 16:40:02.325216", "name": "name1", "deployment": "found", "secret": "correct"}
If "deployment": "not_found", I would like to have a table like:
time | name | deployment |
2022-01-20 16:40:02.325216 | name1 | not_found |
If "secret": "incorrect", I would like to have a table like:
time | name | secret |
2022-01-20 16:40:02.325216 | name1 | incorrect |
Currently, my search looks like this:
index=index host=host source=source ("not_found" OR "incorrect")
| table time name deployment secret
But this means that both fields (deployment and secret) will be shown no matter what their value is.
@Ayn Is there a way to have a table which varies its fields depending on a certain condition?
Thanks in advance!
See if something like this works for you.
index=index host=host source=source ("not_found" OR "incorrect")
| table time name deployment secret
| eval metric=if(deployment="not found", "deployment", "secret")
| eval val=if(deployment="not found", "not found", "incorrect")
| table time name metric val
| eval {metric}=val
| fields - metric val
A table can have only one set of headings. You can combine two columns into one using coalesce. For example, this query will create a 3-column table with either deployment or secret in column3. The trick for the reader, however, is to determine which it is.
index=index host=host source=source ("not_found" OR "incorrect")
| eval column3 = coalesce(deployment, secret)
| rename column3 as "deployment or secret"
| table time name "deployment or secret"