topic Re: Unable to filter based on 2 fields in Reporting

Unable to filter based on 2 fields- Help with syntax

POR160893 — Wed, 23 Nov 2022 14:05:25 GMT

Hey, I have a big query and I need to have a command on the query that would filter all Asset_State!="Development" OR Asset_State!="Pre-Production", bit for ONLY Asset_Environment!="PKI AND Offline" Status="2".

If tried the following command:
| if( Asset_Environment!="PKI AND Offline" Status="2".,search NOT (Asset_State!="Development" OR Asset_State!="Pre-Production"))

I know the syntax is wrong, can you help ?
Many thanks

Re: Unable to filter based on 2 fields

gcusello — Wed, 23 Nov 2022 10:14:15 GMT

Hi @POR160893,

you canoot insert an if conditon in a search, it's possible to use if only in eval command, but you could use something like this, to adapt to your situation:

if you want to exclude events with Asset_State!="Development" OR Asset_State!="Pre-Production", bit for ONLY Asset_Environment!="PKI AND Offline" Status="2":

... | search NOT ((Asset_State!="Development" OR Asset_State!="Pre-Production") Asset_Environment!="PKI Offline_Status=2)

Ciao.
Giuseppe