How to add string on a field value?

[auaave]

Hi Guys!

I am creating a table with number of errors per robot. The field values of these robots are "IGH2001", "IGH2002" and "IGH2003".
I used a rex command and was able to extract the last 3 digits which are 001, 002 and 003.

Now, I wanted to add "Robot" in front of the 3 digits to have field values of Robot 001 Robot 002 Robot 003.
How can I do that?

Thank you!

[harsmarvania57 · Accepted solution]

Hi @auaave,

Can you please try something like this, first 4 lines used to generate dummy data only.

| makeresults 
| eval field1="001"
| append [ | makeresults | eval field1="002"]
| append [ | makeresults | eval field1="003"]
| eval newfield="Robot"." ".field1

[auaave]

@harsmarvania57, thanks for your reply! Based on your input, I have written the code as per below. However, I am having this error "Error in 'makeresults' command: This command must be the first command of a search. "

| chart count(IDEVENT) as ERROR_QTY by ERROR_DESC
| rex field=ROBOT "(?(0\d+))"
| makeresults
| eval field1="001"
| append
[| makeresults
| eval field1="002"]
| append
[| makeresults
| eval field1="003"]
| eval newfield="Robot"." ".field1
| sort ERROR_QTY DESC LIMIT=10

[harsmarvania57]

Query which I had provided was generating dummy data so you do not require first 4 lines from my query . Now based on query you have provided, you are not capturing regex output in any field, try something like this (But I am bit surprised that in chart command you are not using field ROBOT then how can you use ROBOT field in rex command after chart command ??

| rex field=ROBOT "(?<extracted_field>(0\d+))" 
| eval extracted_field="Robot"." ".extracted_field 
| chart count(IDEVENT) as ERROR_QTY, values(extracted_field) as extracted_field by ERROR_DESC 
| sort ERROR_QTY DESC LIMIT=10

In above query 001, 002, 003 ... will store into new field called extracted_field and after that we are concatenating Robot with output value in that field.

EDIT: Updated query.

[auaave]

@harsmarvia57, thanks a lot! the last one worked!! 🙂

[harsmarvania57]

You're welcome.