Field name and value to another Field name with different value

[kyi]

Hello All,

We have a extracted field (example field name "Field1) with multiple value such as YYN, YNN, NYN etc.

Based on the current field and field value, would like to have "NewFieldName" and match the result as below smaple.

Sample

Field1 NewFieldName

YYN "OK"

YNN "NOT OK"

NYN "NOT OK"

Thanks🙏

[yeahnah · Accepted solution]

Hi @kyi 

You sure can.  Something like this run anywhere example 

| makeresults
| eval field1=split("YYN,YNN,NYN,YYY", ",")
| mvexpand field1
 ``` above creates dummy events and is not needed ```
  ``` example below ```
| eval NewFieldName=case(field1="YYN", "OK", field1="YNN", "NOT OK", field1="NYN", "NOT OK", true(), "No match")
| table field1 NewFieldName

 Hope it helps

[kyi]

Thank You for your quick response and solution.

Apart from using Eval in the search, any other option we can use for matching? 

For example: every time extracted field1 with value we can directly use NewFieldName and it matching value?

[yuanliu]

You have not explained the logic to assign OK or not OK.  You haven't even explained whether your real data is just three characters.  If it is just that YYN has two "Y"s, this will do

| eval char = split(field1, "")
| stats count by field1 char
| where char == "Y"
| eval NewFieldName = if(count == 2, "OK", "NOT OK")

[kyi]

Thanks for you information, will do more explanation next time.