Dynamic column name

[smolcj]

Hi,
My search is like given below and my column names are source file names. As the source file name consists of directory name, timestamp etc, it is too long to be a column name. I have extracted another field log_name with just the name of the source file without any time stamp or other stuffs. but how can i use the log_name variable in the search so that i can replace the source file name with log name.

I know that, there is an alternative idea of extracting the log_name during search time but i don't want the search to be some more lengthy, so i didn't do that. I am curious to know whether there is any other alternative for the same.
Search Query :

 index=main  source="$sources$" 
| stats values(wrkf) as "Work Name", values(name) as "Name", values(folder) as "Folder Name", values(reponame) as "Repo Name", values(version) as "Version", values(mode) as "Mode",values(order) as "Order"
|transpose 
|rename column as Properties, "row 1" as "$sources$"
|appendcols [ search  index=main  source="$sourcessecond$" 
    | stats values(wrkf) as "Work Name", values(name) as "Name", values(folder) as "Folder Name", values(reponame) as "Repo Name", values(version) as "Version", values(mode) as "Mode",values(order) as "Order"
     |transpose |rename column as Properties, "row 1" as "$sourcessecond$"] 
|where  '$sources$'!=  '$sourcessecond$'

Please Help
Thank You

[lguinn2]

If you have extracted a field named log_name, you can use it in the search like any other field. For example,

index=main log_name=whatever

[smolcj]

thanks lguinn !!! but how can i replace it instead of $sources$ and $sourcessecond$ in

 

     |rename column as Properties, "row 1" as "$sourcessecond$"] 

|where  '$sources$'!=  '$sourcessecond$'

[jldebell]

Hi - I have something similar. I was curious to see if you were able to figure it out? I am extracting the action from the logs using regex. Then timecharting. i have three actions listed and i wanted to rename the column headers.

Search is:

index=app_example
sourcetype=provision_example
|rex field=_raw "(?logErrorResult\s+[\d+]+:[A-Za-z\s+]+\s+)"

|search action="*"

|timechart span=1d count by action

So displayed is showing something like the following:

_time action results (code #1) action results (code #2) action results (code #3)
2015-01-28 Rename to User Failure Rename to System Failure Rename to User/System

I want to rename the code # to the message listed below.

Thanks!