How to show only related fields when condition matches

[vikashperiwal89]

Hi Team,

I am trying to create a search which says 

If myField= xyz, then i need to show id , salary ,department fields in table

If myField = abc then need to show location, address, phone fields in tabke

Similarly if myField = ddd then need to show age, ht, gender.. fields in table

i was trying to use case , if statement but not sure how to get multiple fields in table based on condition....by using drop it would be easy as i can set condition and get the output , but want to do this in search..

[gcusello · Accepted solution]

Hi @vikashperiwal89,

if you have few conditions, you could try something like this:

Your_search
| eval display_fields=case(myField="xyz", id." - ".salary." - ".department, myField="abc", location." - ".address." - ".phone, myField="ddd",age." - ".ht." - ".gender)
| table _time myField display_fields

if you don't like to have all the fields in one field you can divide them after.

Ciao.

Giuseppe

[vikashperiwal]

@gcusello , 

The solution works , but i am getting all the fields values concatenated under one field.

Is it possible we have have each field as separate for example, extending the below use case

Your_search
| eval display_fields=case(myField="xyz", id." - ".salary." - ".department, myField="abc", location." - ".address." - ".phone, myField="ddd",age." - ".ht." - ".gender)
| table _time myField display_fields

I want in below format

_time	myField	Id	salary	department
time vaue	xyz	1	1000000	cse
time value	xyz	2	2000000	IT

[DaveB]

I had a similar desire to change the number of fields displayed dependant on a condition. mine was triggered by a dropdown selection, so I set a token when the drop down was  changed   ,that token held a list  of the fields i wanted to display.

at the end of my search i used 

| fields=$myfields$

and it works perfectly. dont think it is possible within the search it self, but if the fields could be set based on the results of another search or an input box it should be possible

[gcusello]

Hi @vikashperiwal,

yes, as I said, if you want divided fields, you have to divide them after display using e.g. a regex:

| rex field=display_fields "^(?<field1>[^-]+)-(?<field2>[^-]+)-(?<field3>.+)"

The problem is to give the correct name field to the column because SPL isn't a procedural language so you cannot rename a field based on an if  condition.

Ciao.

Giuseppe