hi
As you can see below, I am doing a stats with the field "process_name"
In order to be more comprenhensive, I am doing a rename of this field with a case function
But in my table, I would like to display this field 2 times : one time with the original name and another time with the name done after the rename
How I can do this please??
| stats values xxxxxx by host process_name
| eval process_name=case(process_name like "mfev%" OR process_name like "mcdatrep" OR process_name=="mcshield")
| rename process_name as "Process name"
| table "Process name"
Maybe evaluate it to a new field.
| stats values xxxxxx by host process_name
| eval "Process name" =case(process_name like "mfev%" OR process_name like "mcdatrep" OR process_name=="mcshield")
| table "Process name" process_name
Maybe evaluate it to a new field.
| stats values xxxxxx by host process_name
| eval "Process name" =case(process_name like "mfev%" OR process_name like "mcdatrep" OR process_name=="mcshield")
| table "Process name" process_name
no doesnt works
JIP31 check what your case statement, for me it returns an error.
Without seeing your data I cant be sure I have your syntax right, but maybe try the below.
| eval process_name=case(process_name
like "mfev%",process_name,
process_name like "mcdatrep",
process_name,
process_name=="mcshield",
process_name) | eval "Process name" =
process_name | table "Process name"
process_name
like this it works thanks!