https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-a-problem-with-an-AND-operator-in-a-CASE/m-p/427304#M122333 <P>Hi kumagaur,</P> <P>based on the provided examples this will work:</P> <PRE><CODE>| makeresults | eval TeamMember="A1 A2 A3 A4 A5 A6 A7" | makemv TeamMember | mvexpand TeamMember | eval Team = if((TeamMember="A1" OR TeamMember="A2") AND TeamMember="A4" AND TeamMember="A7", "foo" , "nope") </CODE></PRE> <P><STRONG>But</STRONG>, also based on your provided information this <CODE>eval</CODE> will never match anything because <CODE>TeamMember</CODE> has never at the same time either <CODE>A1</CODE> or <CODE>B2</CODE> <STRONG>and</STRONG> <CODE>A4</CODE> <STRONG>and</STRONG> <CODE>A7</CODE>.</P> <P>I would review either the use case or the events, because this based on the provided information will never work.</P> <P>Hope this helps ...</P> <P>cheers, MuS</P> Thu, 24 Jan 2019 19:09:08 GMT MuS 2019-01-24T19:09:08Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-a-problem-with-an-AND-operator-in-a-CASE/m-p/427303#M122332 <P>I have one lookup in which there is a field which consist</P> <PRE><CODE>Team Member A1 A2 A3 A4 A5 A6 A7 </CODE></PRE> <P>Now,If <BR /> TeamMember=(A1 OR A2) AND A4 AND A7 then print Aseries<BR /> TeamMember=(A1 OR A2) and A5 AND A6 then print Bseries</P> <P>I tried:</P> <PRE><CODE> |eval Team=if((con1=="A1 OR con1=A2)"AND con1=="A4" AND con1=A7,Aseries,Other) </CODE></PRE> <P>I used case as well but no luck.</P> Thu, 24 Jan 2019 18:23:18 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-a-problem-with-an-AND-operator-in-a-CASE/m-p/427303#M122332 kumagaur 2019-01-24T18:23:18Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-a-problem-with-an-AND-operator-in-a-CASE/m-p/427304#M122333 <P>Hi kumagaur,</P> <P>based on the provided examples this will work:</P> <PRE><CODE>| makeresults | eval TeamMember="A1 A2 A3 A4 A5 A6 A7" | makemv TeamMember | mvexpand TeamMember | eval Team = if((TeamMember="A1" OR TeamMember="A2") AND TeamMember="A4" AND TeamMember="A7", "foo" , "nope") </CODE></PRE> <P><STRONG>But</STRONG>, also based on your provided information this <CODE>eval</CODE> will never match anything because <CODE>TeamMember</CODE> has never at the same time either <CODE>A1</CODE> or <CODE>B2</CODE> <STRONG>and</STRONG> <CODE>A4</CODE> <STRONG>and</STRONG> <CODE>A7</CODE>.</P> <P>I would review either the use case or the events, because this based on the provided information will never work.</P> <P>Hope this helps ...</P> <P>cheers, MuS</P> Thu, 24 Jan 2019 19:09:08 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-a-problem-with-an-AND-operator-in-a-CASE/m-p/427304#M122333 MuS 2019-01-24T19:09:08Z