https://community.splunk.com/t5/Splunk-Search/How-to-match-case-on-multiple-value-assigned/m-p/619074#M215169 <P>Hi all,</P><P>I'm trying to create category based on host category: Lab,Personal,Staff and get workstations to be counted for each category.&nbsp;<SPAN>I tried using below and it gives desired results&nbsp;however it doesn't work when I applied boolean&nbsp;expression (OR) on more details in certain category.</SPAN></P><P><SPAN>&lt;base search&gt;| eval category = case(match(host,"ABC-*"),"Staff",match(host,"DESKTOP*" <STRONG>OR</STRONG> host,"PC-*"),"Lab",true(),"Personal")|stats count by category,host|sort -count|stats sum(count) as Total list(host) as Workstation_Name list(count) as count by category|where Total&gt;1|sort Total</SPAN></P><P><SPAN>Expected Result:</SPAN></P><P><SPAN>category | Total |&nbsp; &nbsp; &nbsp;Workstation_Name&nbsp; &nbsp; &nbsp;| count</SPAN></P><P><SPAN>&nbsp; &nbsp; Staff&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 5&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;ABC123&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 2</SPAN></P><P><SPAN>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;ABC345&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;3</SPAN></P><P><SPAN>&nbsp; &nbsp; &nbsp;Lab&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;DESKTOP123&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1</SPAN></P><P><SPAN>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;PC123&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1</SPAN></P><P><SPAN>&nbsp; &nbsp; &nbsp;Personal&nbsp; &nbsp;1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Etc...&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1</SPAN></P><P>&nbsp;</P><P>Any help would be much appreciated!</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Tue, 01 Nov 2022 09:32:39 GMT aa0 2022-11-01T09:32:39Z https://community.splunk.com/t5/Splunk-Search/How-to-match-case-on-multiple-value-assigned/m-p/619074#M215169 <P>Hi all,</P><P>I'm trying to create category based on host category: Lab,Personal,Staff and get workstations to be counted for each category.&nbsp;<SPAN>I tried using below and it gives desired results&nbsp;however it doesn't work when I applied boolean&nbsp;expression (OR) on more details in certain category.</SPAN></P><P><SPAN>&lt;base search&gt;| eval category = case(match(host,"ABC-*"),"Staff",match(host,"DESKTOP*" <STRONG>OR</STRONG> host,"PC-*"),"Lab",true(),"Personal")|stats count by category,host|sort -count|stats sum(count) as Total list(host) as Workstation_Name list(count) as count by category|where Total&gt;1|sort Total</SPAN></P><P><SPAN>Expected Result:</SPAN></P><P><SPAN>category | Total |&nbsp; &nbsp; &nbsp;Workstation_Name&nbsp; &nbsp; &nbsp;| count</SPAN></P><P><SPAN>&nbsp; &nbsp; Staff&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 5&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;ABC123&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 2</SPAN></P><P><SPAN>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;ABC345&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;3</SPAN></P><P><SPAN>&nbsp; &nbsp; &nbsp;Lab&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;DESKTOP123&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1</SPAN></P><P><SPAN>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;PC123&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1</SPAN></P><P><SPAN>&nbsp; &nbsp; &nbsp;Personal&nbsp; &nbsp;1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Etc...&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1</SPAN></P><P>&nbsp;</P><P>Any help would be much appreciated!</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Tue, 01 Nov 2022 09:32:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-match-case-on-multiple-value-assigned/m-p/619074#M215169 aa0 2022-11-01T09:32:39Z https://community.splunk.com/t5/Splunk-Search/How-to-match-case-on-multiple-value-assigned/m-p/619079#M215174 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/246667">@aa0</a>,</P><P>thesecond condition of the case is wrong and&nbsp;then there's the problem that the values in list are sorted by value, so they aren't aligned and you have to make a workaround:</P><P>&nbsp;</P><LI-CODE lang="markup">&lt;base search&gt; | eval category=case(match(host,"ABC-*"),"Staff",match(host,"DESKTOP*") OR match(host,"PC-*"),"Lab",true(),"Personal") | stats values(category) AS category count by host | eval column=host."|".count | stats sum(count) as Total values(column) as column BY category | where Total&gt;1 | rex field=column "^(?&lt; Workstation_Name&gt;[^\|]+)\|(?&lt;count&gt;\d+)" | sort Total | table category Total Workstation_Name count</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Tue, 01 Nov 2022 09:45:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-match-case-on-multiple-value-assigned/m-p/619079#M215174 gcusello 2022-11-01T09:45:00Z https://community.splunk.com/t5/Splunk-Search/How-to-match-case-on-multiple-value-assigned/m-p/619080#M215175 <LI-CODE lang="markup">| eval category = case(match(host,"ABC-*"),"Staff",match(host,"DESKTOP*") OR match(host,"PC-*"),"Lab",true(),"Personal")</LI-CODE> Tue, 01 Nov 2022 09:48:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-match-case-on-multiple-value-assigned/m-p/619080#M215175 ITWhisperer 2022-11-01T09:48:54Z