Create a table with different fields depending if their values match a condition

[andres]

I have a raw where each event looks like this (simplified for this exampel):
{"time": "2022-01-20 16:40:02.325216", "name": "name1", "deployment": "found", "secret": "correct"}

If "deployment": "not_found", I would like to have a table like:

time	name	deployment
2022-01-20 16:40:02.325216	name1	not_found

If "secret": "incorrect", I would like to have a table like:

time	name	secret
2022-01-20 16:40:02.325216	name1	incorrect

Currently, my search looks like this:

index=index host=host source=source ("not_found" OR "incorrect")
| table time name deployment secret

But this means that both fields (deployment and secret) will be shown no matter what their value is.

@Ayn Is there a way to have a table which varies its fields depending on a certain condition?

Thanks in advance! 

[somesoni2]

See if something like this works for you.

index=index host=host source=source ("not_found" OR "incorrect")
|  table time name deployment secret
|  eval metric=if(deployment="not found", "deployment", "secret")
|  eval val=if(deployment="not found", "not found", "incorrect") 
|  table time name metric val 
|  eval {metric}=val 
|  fields - metric val

[richgalloway]

A table can have only one set of headings.  You can combine two columns into one using coalesce.  For example, this query will create a 3-column table with either deployment or secret in column3.  The trick for the reader, however, is to determine which it is.

index=index host=host source=source ("not_found" OR "incorrect")
| eval column3 = coalesce(deployment, secret)
| rename column3 as "deployment or secret"
| table time name "deployment or secret"