{} equivalent on right hand side of eval

[usd0872]

I hate hardcoding dynamic things. Sooner or later those thing break. I have data with fields

... forecast_2020=400, forecast_2021=500, forecast_2022=650, forecast_2023=800 ...

and in some search I need to use the correct forecast for the current year.

What I could do is

...
| eval year=strftime(now(),"%Y"),
       forecast=case(year==2021, forecast_2021,
                     year==2022, forecast_2022,
                     year==2023, forecast_2023,
                     1==1,       0)

This definitely results in problems in 2024; by then I will have a field forecast_2024 but nobody will remember to update the search.

I'd rather use something along these lines:

...
| eval year=strftime(now(),"%Y"),
       forecast=coalesce(forecast_{year}, 0)

However, the {} trick can only be used on the left hand side in eval. Is there any similar cool trick which works on the right hand side?

[PickleRick]

Ugly but should work. Use foreach.

For example:

| makeresults count=3
| eval a1=2,a2=5,a3=8
| streamstats count
| foreach a* 
   [ eval result=if (<<MATCHSTR>> = count,<<FIELD>>,result)]

 Adjust to your needs (make the condition reference current year) and you're good to go.

[usd0872]

Yep, foreach is the way to solve this. Thank you.

[ITWhisperer · Accepted solution]

Not exactly since it still uses {} on the left, but using foreach you could do this

| makeresults 
| eval year=strftime(now(),"%Y")
| eval forecast_2021=random()%100


| eval year_{year}=year
| foreach year_*
    [| eval forecast=coalesce(forecast_<<MATCHSTR>>,0)]

[usd0872]

Bingo! A good way to achieve the result. It fits my need perfectly, I just could not think of it myself. Thank you.