i have a search that i need to modify the field A based on results of field B

[rwiley]

i have an index with field (Value) that brings in results as bytes or percentage according to what the (counter) field is. example i need to round (value) field to two decimal places if (counter=available bytes) or round (Value) field if (counter=%free space).

[javiergn · Accepted solution]

Not sure if I understood correctly your question so if that's not the case please post an example.

In any case, try this and let me know if that's what you are looking for:

your search here
| eval Value = case (
    counter == "available bytes", round(Value, 2),
    counter == "%free space", round(Value),
    1 == 1, "OTHERS"
)

The 1 == 1 is just a default clause to make sure you are not ignoring any potential values. You can then search Value = OTHERS to find out if something didn't match any of the previous two clauses.

Thanks,
J

[rwiley]

this is what i needed. i made an edit but i guess it did not save. the available bytes i needed to convert bytes to Gb. i tried this sum(Value/1024/1024)

[javiergn]

You need to convert your Value to GB before using sum.
Something like:

 your search here
 | eval Value = case (
     counter == "available bytes", round(Value/1024/1024, 2),
     counter == "%free space", round(Value),
     1 == 1, "OTHERS"
 )

[javiergn]

By the way, if the response above is what you were looking for please do not forget to mark it as answered so that others can benefit from it.

Thanks
J

[rwiley]

it does work. it didn't put the results where i needed them. i am trying to manipulate it to get everything the way i need it to work. thank you