Using field values from a lookup to modify other field values

[FelixLeh]

Hey everyone,
above you can see an example of what I can expect in my work environment..
My goal is to modify the values from "tag_value" with the values of "tag_modifier" 
eg. : "True" -> "is : True"          or  "1611156456" -> "2021-01-20T16:27:36+0100" 

The "tag_modifier" field is sourced from a lookup where I want to create a similar value for every "tag_type" to easily add and manage my tag_modifiers even with great amounts of tag_types

Is there any way to do this?  ( case() macro is not an option because of the amount of tag_types)
Thanks in advance for any help!

[manjunathmeti]

hi @FelixLeh ,

Try this:

| makeresults 
| eval _raw="tag_modifier;tag_type;tag_value
strftime(tag_value, \"%x %X\");tag_time;1611681945
\"is: tag_value\";tag_active;True
tag_value;tag_count;56
strptime(tag_value, \"%x %X\");tag_time;01/26/21 22:55:45" 
| multikv forceheader=1 
| fields _time, tag_modifier, tag_type, tag_value 
| eval tag_value1=replace(tag_modifier, "tag_value", tag_value) 
| rex field=tag_modifier "\"(?<format>[\w\W]+)\"\)" 
| eval tag_value=if(like(tag_modifier, "%strftime%"), strftime(tag_value, format), strptime(tag_value, format)) 
| eval tag_value=coalesce(tag_value, tag_value1)

If this reply helps you, an upvote/like would be appreciated. 

[FelixLeh]

Even though it would technically work it's not quite what I'm looking for. My goal was to avoid if or case functions to make the formatting of the tag_value easier.. but maybe it's the only possible way. 
Thanks for your suggestion though! Maybe it'll help anyway.