How to rename a conditional field?

[JohnEGones]

Hi guys,

I need some help trying to rename a specific field on condition that the renamed field is associated with one or more separate fields.

Fields:

Device_Name
Device_Interface
SomeField

Pseudocode:

<some query>
| if(Device_Name="Value1" AND Device_Interface="Value2" AND SomeField>="NumberX") --> rename Value2 as "This String"
| if(Device_Name="Value1A" AND Device_Interface="Value2A" AND SomeField<"NumberY") --> rename Value2A as "This Other String"

[ITWhisperer]

| eval Device_Interface=case(Device_Name="Value1" AND Device_Interface="Value2" AND SomeField>="NumberX","This String",Device_Name="Value1A" AND Device_Interface="Value2A" AND SomeField<"NumberY","This Other String",true(),Device_Interface)

[richgalloway]

The rename command can't use conditions, but eval can.

<some query>
| eval "This String" = if(Device_Name="Value1" AND Device_Interface="Value2" AND SomeField>="NumberX", Value2, null())
| eval "This Other String" = if(Device_Name="Value1A" AND Device_Interface="Value2A" AND SomeField<"NumberY", Value2A, null())

[JohnEGones]

Hi Rich (and Giuseppe),

I appreciate the prompt response, I realized that I messed up what I was asking, so some clarification:

<some search>
| stats count by Device_Name, Device_Interface, SomeField
| (here I want to rename the field *values* in Device_Interface that match the previous conditions, not rename the fieldname itself.)

So here I am renaming the below field value:
Device_Interface="xyz" ==> Device_Interface="x_y_z"

BEFORE rename (this is a sample line from the stats output):
DeviceName, xyz, someValue

AFTER rename:
DeviceName, x_y_z, someValue

[richgalloway · Accepted solution]

Fields have a name and values.  They can be renamed.  Values do not have names so they cannot be renamed.

To change a value of a field, use the eval command to assign a new value.

| eval Device_Interface="x_y_z"

To change selected values of a field, use a condition within the eval.

| eval Device_Interface = if(Device_Interface="foo", "bar", Device_Interface)

Putting the field name in the else clause leaves the value unchanged if the condition is not met.

[JohnEGones]

Rich,

Ok, this is it. Thank you.

LOL. Some of this is simple when you see/get it, but SPL's versatility sometimes makes simple things opaque/unobvious to me.

@gcusello 

Hi Giuseppe,

Thank you for your responses as well

Yeah, it is the second one, but I guess I was unsure if it is better to say, do this as a lookup, based on the number of potential renames, or whether it is less effort to just define the conditions to trigger the rename based on the results from the stats output, since it isn't always the case that a specific interface value will populate.

But coming back to original question, I have clarity on how to proceed given Rich's response.

[gcusello]

Hi @JohnEGones,

probably there's a terms misunderstanding:

do you want to rename the field name or assign a value to the field based on a condition?

if the first case, please, define the old and the new name to assign to the field and the conditions.

If the second, please define the field to assign the value and the conditions for all the values.

Ciao.

Giuseppe

[gcusello]

Hi @JohnEGones,

you have to use eval with if or case, something like this:

<your_seaRCH>
| eval Value2=if(Device_Name="Value1" AND Device_Interface="Value2" AND SomeField>="NumberX"),"This String",Value2)
| eval Value2A=if(Device_Name="Value1A" AND Device_Interface="Value2A" AND SomeField<"NumberY"),"This Other String",Value2A)

 Ciao.

Giuseppe