How to group some of field value into new fields value?

[syazwani]

Hi peeps,

Need help to do some query. Basically I'm trying to group some of field value in the 'Category' field into new fields call 'newCategory'. Below are the sample of data:

The newCategory field will have the new count for each of the new field value (such as Anonymizers, Gambling, Malicious Site).

Please help. 

Thank you.

[syazwani]

Hi @yuanliu , thanks for reply. This solution worked. I try to do 

[yuanliu · Accepted solution]

This depends a lot on when you want this transformation.  If you want to see transformation before stats, it will depends on data characteristics.  Now, assuming you only want the transformation after | stats count by category, you can do

| eval newCategory = case(category IN ("Anonymizers", "Anonymizing Utilities", "Anonymizing Utilities, Internet Services"), "Anonymizers", category LIKE "Gambling%", "Gambling", category LIKE "Malicious Sites%", "Malicious Sites", true(), "Undef")