strip off a part of a search field

[sugethakch]

I have a search query that goes like this:
sourcetype="inv" Inv name=* | table name, intf, model, serialnum, mfgname | dedup switchname intf | stats count by ....

I want to do, stats counts by name in this case. If I search by intf=*, then I want to do, stat count by intf and so on.

I tried something like this,
sourcetype="inv" Inv name=* | table name, intf, model, serialnum, mfgname | dedup switchname intf | eval n=rtrim("name=","=") | stats count by n

But, that didn't work. I see why. But, how do I achieve that?

[woodcock]

I would use a macro like this in macros.conf:

[MyMacro(1)]
args = fieldname
definition = sourcetype="inv" Inv $fieldname$=* | table name, intf, model, serialnum, mfgname | dedup switchname intf | stats count by $fieldname$

Then call it like this:
... | `MyMacro(name)`
And like this:
... | `MyMacro(intf)`

[musskopf]

Just trying to understand the context and your use case... as you'll be changing the first part of the search anyway, why don't update the last bit at same time?

[vganjare]

Can macro help in this case?