How do you store multiple similar field names as values in a new field?

[mpatel11]

I have multiple fields with similar names abc*, example:
abcXYZ1
abcKLM
abc_DEF

I want to create a new field, say 'EVENT' which will have values as abc* field names. So, values of 'EVENT' = abcXYZ1, abcKLM and abc_DEF

[kamlesh_vaghela · Accepted solution]

@mpatel11

Can you please try this?

YOUR_SEARCH   | foreach abc* [ eval EVENT=if(isnull(EVENT),"<<FIELD>>",EVENT.","."<<FIELD>>") ]

My Sample Search:

|makeresults |  eval abcXYZ1="AAA",
abcKLM="BBB",
abc_DEF="CCC" | foreach abc* [ eval EVENT=if(isnull(EVENT),"<<FIELD>>",EVENT.","."<<FIELD>>") ]

Updated Answer:

   YOUR_SEARCH | foreach abc* 
    [ eval EVENT = case(isnull(EVENT) AND isnotnull(<<FIELD>>),"<<FIELD>>",isnotnull(EVENT) AND isnotnull(<<FIELD>>),EVENT.","."<<FIELD>>",1=1,EVENT)]

Sample Search

| makeresults 
| eval abcXYZ1="AAA",
    abcKLM="BBB",
    abc_DEF="CCC" 
| append 
    [| makeresults 
    | eval abcXYZ1="AAA",
        abcXYZ="BBB",
        abc_DEF1="CCC" ] 
| append 
    [| makeresults 
    | eval abcXYZ1="AAA",
        abcXYZ2="BBB",
        abc_DEF2="CCC" ] 
| foreach abc* 
    [ eval EVENT = case(isnull(EVENT) AND isnotnull(<<FIELD>>),"<<FIELD>>",isnotnull(EVENT) AND isnotnull(<<FIELD>>),EVENT.","."<<FIELD>>",1=1,EVENT)]

Thanks

[mpatel11]

This works exactly as requested. Thanks.

I would actually like to enhance on the question.
Say I have 100 rows of logs.
some have only Field abcXYZ1 and not the other 2, some have field abcKLM and not the other 2 and so on...
so occurrence of fields abc* is mutually exclusive.

Now based on this, want to add another field EVENT which will look if that log has field abcXYZ1 then value of EVENT = abcXYZ1, if a log has field abcKLM then EVENT=abcKLM and so on...

So looking at a log and finding which type of field it has based on abc*, only that fields name will be stored as value in the new field EVENT.

Hope it is clear to understand.

[mpatel11]

never mind, I'll post this as a separate question. Thanks for the help Kamlesh.

[kamlesh_vaghela]

@mpatel11

Apology for the late reply. Please check my updated answer.

[mpatel11]

Updates answer also works like a charm. Thanks for the help..

[kamlesh_vaghela]

Gald to help you mpatel.