Hello All, Can someone please help me understand the functionality of AUTO_KV_JSON? Does it modify the functionality of KV_MODE? If so, under what scenario? From my experiments it doesn't seem to do anything when traversing the permutations of INDEX_EXTRACTIONS, KV_MODE and AUTO_KV_JSON. We typically just use the following settings in our sourcetype definitions: KV_MODE=json AUTO_KV_JSON=true   Here is the table of results Appreciate a response. Thank you.   ... View more

I have a single algorithm with 2 methods. Each method produces the same type of data but with different fields names to keep them separated. The dashboard charts depend on which method the user selects in a menu. Essentially I create interim results for both methods but desire to change the names to the field names used in the subsequent code. [Q] What is a more efficient method of performing the "Big Switch" in the run anywhere code below?   | makeresults 5 | rename comment AS "-----------------------------------------------------------------" | rename comment AS "User Menu Selection" | eval switch="A" | rename comment AS "-----------------------------------------------------------------" | rename comment AS "Algorithm element2" | eval calcMethod1_field1="1" | eval calcMethod1_field2=2 | eval calcMethod1_field3=3 | eval calcMethod1_field4=4 | eval calcMethod1_field5=5 | rename comment AS "-----------------------------------------------------------------" | rename comment AS "Algorithm element2" | eval calcMethod2_field1="1sub" | eval calcMethod2_field2="2sub" | eval calcMethod2_field3="3sub" | eval calcMethod2_field4="4sub" | eval calcMethod2_field5="5sub" | rename comment AS "-----------------------------------------------------------------" | rename comment AS " Big Switch " | rename comment AS "-----------------------------------------------------------------" | rename comment AS "This is the big switch before entering a stats command" | rename comment AS "Intent is to rename several fields depending on switch value" | eval fieldnameforstats_field1=case(switch=="A",calcMethod1_field1,switch=="B",calcMethod2_field1) | eval fieldnameforstats_field2=case(switch=="A",calcMethod1_field2,switch=="B",calcMethod2_field2) | eval fieldnameforstats_field3=case(switch=="A",calcMethod1_field3,switch=="B",calcMethod2_field3) | eval fieldnameforstats_field4=case(switch=="A",calcMethod1_field4,switch=="B",calcMethod2_field4) | eval fieldnameforstats_field5=case(switch=="A",calcMethod1_field5,switch=="B",calcMethod2_field5) | fields - _time | table fieldnameforstats_field*   ... View more