topic Re: Multiple case statement conditions? in Alerting

Multiple case statement conditions?

karthi2809 — Thu, 14 Mar 2024 14:35:27 GMT

Hi Guys,

In this case statement i am getting jobType values but i am not getting Status value. I already mentioned the keyword above in the query But why i am not getting .

index="mulesoft" applicationName="s-concur-api" environment=DEV timestamp ("onDemand Flow for concur Expense Report file with FileID Started" OR "Exchange Rates Scheduler process started" OR "Exchange Rates Process Completed. File successfully sent to Concur")|transaction correlationId| rename timestamp as Timestamp correlationId as CorrelationId tracePoint as TracePoint content.payload.TargetFileName as TargetFileName | eval JobType=case(like('message',"%onDemand Flow for concur Expense Report file with FileID Started%"),"OnDemand",like('message',"%Exchange Rates Scheduler process started%"),"Scheduled", true() , "Unknown")| eval Status=case(like('message',"Exchange Rates Process Completed. File sucessfully sent to Concur"),"SUCCESS",like('TracePoint',"%EXCEPTION%"),"ERROR") |table JobType Status

Re: Multiple case statement conditions?

ITWhisperer — Thu, 14 Mar 2024 15:08:52 GMT

Without some sample events, it is difficult to determine what might be wrong with your search. Having said that, I noticed that the first option in your case function for Status does not have any wildcards in the pattern for the like function. Could this be the issue?

Re: Multiple case statement conditions?

richgalloway — Thu, 14 Mar 2024 15:18:09 GMT

If a case function returns no value it's because none of the expressions matched. Adding a default expression

| eval foo = case(..., 1==1, "???")

will help flag edge cases that don't match the other expressions.

In this instance, it seems the first expression needs some wildcards unless you're looking for an exact match.

| eval Status=case(like('message',"%Exchange Rates Process Completed. File sucessfully sent to Concur%"),"SUCCESS", like('TracePoint',"%EXCEPTION%"),"ERROR")