I have a dashboard that let's users enter in the type of events they want to search for. Every type of event returns a different set of fields which is then displayed in a table. Since the final output is a single table I have to account for every possible field that may generate from all events, if a field does not apply to a event I used eval to set the value for that field to "not applicable".
Is there a way to show a different table (with different fields) depending on a condition that is selected ? I would have imaged that just using this at the end would do the job but no, instead only the first eval is evaluated.
| eval ShowTable = if(EventCode=="1") | table Time,Host,DN,Status
| eval ShowTable = if(EventCode=="2") | table Time,Host,PN,Value
| eval ShowTable = if(EventCode=="3") | table Time,Host,Action,Status
... View more