How to use a columns value as a key to a different column for my results id like to output?

[zsaf]

I have two columns per event I am trying to use. Well call these col1 and UknownRandomColumnName (urcn for short) . The key of urcn changes from event to event, but the value of col1 will always be the key of urcn. How can I use the value of col1 as a key for the data id like to output from urcn in a search. Example data for my events may look like:

=======================
|    col       |    urcn1    |    urcn2    |
======================
|    urcn1 |    Value    |                     |
---------------------------------------
|    urcn2 |                    |     Value    |
--------------------------------------

[PickleRick]

I'm not sure I get what you want but it seems you might need xyseries.

[zsaf]

Hey,  my desired output I guess would be a table with the values from the ucrn columns. 

[PickleRick]

As I said - I'm not sure I understand you correctly, but I assume that you have events in the form of

"name: field1name, value: fieldvalue"
"name: field2name, value: fieldvalue"

And you want to get:

field1name: fieldvalue
field2name: fieldvalue

And so on.

Check untable and xyseries (I always confuse those commands) - one of those should do what you need.

[zsaf]

Here would be an example sample of my events.  The type value contains the key of the property I need to display data from. In my example I would like to output the name and age in each object, but I do not know the property name. The only thing I know ahead of time is that the value of type will be the property name I need to access.

{
type: "fwagods",
fwagods: {
    name:"someNameHere",
    age:23
    }
},
{
type: "zsaf",
zsaf: {
    name:"someName2",
    age:65
    }
},
{
type: "smorflafaum",
smorflafaum: {
    name:"SomeName3",
    age:41
    }
}

[PickleRick]

That's getting more complicated because you have json and it looks as if you have multiple "subevents" within a single event.

But assuming that you have the jsons as separate events, you can do something like that:

<your_search>
| spath
| foreach *.name 
  [ eval name='<<FIELD>>'
   | eval age='<<MATCHSTR>>.age' ]

 At this point you'll have your name and age fields with constant names and you're gonna have a type as separate field. Now all you have to do is

| xyseries type name age