Can AND or OR be used in case statements in eval expressions?

Which case statement?

The eval statement supports this. All you have to do is something like this:

... | stats c(eval(status>400 AND status!=404)) AS FAILURE

Another approach might be to use a lookup table that has all the various HTTP response codes and the resulting status you wish them to have. You'd have to enumerate them and specify a value for each, but it is workable.

Or you can do it through rangemap...

... |  rangemap field=status SUCCESS=0-399 WARNING=404-404 default=FAILURE

Then you have the information in the newly created field 'range'.

Hope this helps,

Kristian

The question was not answered (which seems to be the normal):

So, is:

eval var1 = case(A==0 AND B==1, "ZeroOne", A==1 AND B==0, "OneZero", 1==1, "Neither")

Supposed to be a valid construct?

In my case i can't get it to work. It's either the default branch (1==1) or NULL.

Any hints?

Dirk

I can get it to work with the following search

sourcetype=access_combined status=404 OR status=200 
| dedup 3 status 
| eval tt=if(time_taken<500, "1", "0") 
| eval var1 = case(status==200 AND tt=1, "A", status==404 AND tt==0, "B", 1>0, "C") 
| table status tt var1

For sake of clarity/completeness, I've included the complete search I used. The first three lines are just for getting event data (based off access_combined) to work on, so they don't have any real purpose besides that.

The results table looks like;

status  tt  var1
404     1   C
200     1   A
404     0   B
200     0   C

Hope this helps,

Kristian

I confirm, the boolean expression in case() works. My problem was the following:

To gather one of the needed values to decide on i did the following:

| eval no-value-supplied = if(isnull(mkfind(msisdn, "no-value-supplied")), 1, 0)

Note that the introduced variable and the constant string in the mkfind are identical.

Interesting is:

if you output the variable, e.g. via "table no-value-supplied" the value binding is correct (1 or 0 in this case).

Using no-value-supplied in a boolean statement inside of case

| eval new_var = case(no-value-supplied == 1 AND ....)

never yields true.

Is this a bug, or did i miss something in the documentation?

Renaming the variable fixed the issue.