Multiple case statement conditions?

[karthi2809]

Hi Guys,

In this case statement i am getting jobType values but i am not getting Status value. I already mentioned the keyword above in the query But why i am not getting .

index="mulesoft" applicationName="s-concur-api" environment=DEV  timestamp ("onDemand Flow for concur Expense Report file with FileID Started" OR "Exchange Rates Scheduler process started" OR "Exchange Rates Process Completed. File successfully sent to Concur")|transaction correlationId| rename timestamp as Timestamp correlationId as CorrelationId tracePoint as TracePoint content.payload.TargetFileName as TargetFileName
| eval JobType=case(like('message',"%onDemand Flow for concur Expense Report file with FileID Started%"),"OnDemand",like('message',"%Exchange Rates Scheduler process started%"),"Scheduled", true() , "Unknown")| eval Status=case(like('message',"Exchange Rates Process Completed. File sucessfully sent to Concur"),"SUCCESS",like('TracePoint',"%EXCEPTION%"),"ERROR") |table JobType Status

[richgalloway]

If a case function returns no value it's because none of the expressions matched.  Adding a default expression

| eval foo = case(..., 1==1, "???")

will help flag edge cases that don't match the other expressions.

In this instance, it seems the first expression needs some wildcards unless you're looking for an exact match.

| eval Status=case(like('message',"%Exchange Rates Process Completed. File sucessfully sent to Concur%"),"SUCCESS",
                  like('TracePoint',"%EXCEPTION%"),"ERROR")

[ITWhisperer]

Without some sample events, it is difficult to determine what might be wrong with your search. Having said that, I noticed that the first option in your case function for Status does not have any wildcards in the pattern for the like function. Could this be the issue?