Hi @kenbaugher I think Ive wrapped my head around what you're trying to achieve, please see the following working example, note this is two separate SPL queries - the first to generate a lookup and...
See more...
Hi @kenbaugher I think Ive wrapped my head around what you're trying to achieve, please see the following working example, note this is two separate SPL queries - the first to generate a lookup and second to use it: == First create a lookup ==
|makeresults format=csv data="fieldID,fieldName
F1,FieldName1Example
F2,FieldName2Example
F3,FieldName3Example"
| outputlookup fieldtest.csv
== Example event ==
|makeresults | eval F1="Hello", F2="World", F3="Test"
| foreach F* [|eval test="Friendly"+json_extract(lookup("fieldtest.csv",json_object("fieldID","<<FIELD>>"),json_array("fieldName")),"fieldName"), {test}=<<FIELD>>]
| fields _time Friendly* This loops over fields starting "F" and does a lookup against 'fieldtest.csv" against the "fieldID" field, then sets the value to the friendly field name, after this we then evaluate the existing F<n> value to that friendly field name. Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing