- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hi,
I have this query. If I change fieldformat to eval the query works but if it is left as fieldformat the query returns no results. First time I'm trying to use fieldformat so I don't quite understand what I'm missing.
earliest=-24h index=wholesale_app buildTarget=* product=* CustomAnalytic Properties.index=17 OR Properties.index=19 OR Properties.index=21 OR Properties.index=23 OR (Properties.index=>25 AND Properties.index<=32) buildTarget=* product=* |rename Properties.index as pindex|fieldformat pindextype=case(pindex == "17", "CVR Event Selected", pindex == "19", "CVR Fetch Events",pindex == "21", "CVR Event View Ended", pindex == "23", "CVR Play Pressed",pindex == "25", "CVR Pause Pressed", pindex == "26", "CVR Landscape Orientation",pindex == "27", "CVR Portrait Orientation", pindex == "28", "CVR Jump Forward", pindex == "29", "CVR Jump Back", pindex == "30", "CVR Video Session Started", pindex == "31", "CVR Video Error", pindex == "32", "CVR Range Set")|stats count by pindextype
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

The function fieldformat
is used to change the format of "existing" field without changing underlying value. Here the field pindextype doesn't exist hence can't be used with fieldformat
command. You've to either use eval itself OR use fieldformat with existing field "pindex"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

The function fieldformat
is used to change the format of "existing" field without changing underlying value. Here the field pindextype doesn't exist hence can't be used with fieldformat
command. You've to either use eval itself OR use fieldformat with existing field "pindex"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Of course, your last stats command would change too if you plan to use existing field pindex.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Ahhhhh thats what I missed ... EXISTING field, now it makes sense
Thanks Somesoni2! (again)
