hi all,
i used eval wildcard to create a new field with below command:
*|eval product=case (match(shop_tags,"pen"), "pen", match(shop_tags,"pencil"), "pencil")
i have many tags under shop_tags, but now i have a new product book, it has two types, i want to create a new name "book_west" if it both match book and west, "book_east" if it match book and east. i am not sure how to deal with if i need match two tags to create a new one,
*|eval product=case (match(shop_tags,"pen"), "pen", match(shop_tags,"pencil"), "pencil",match(shop_tags,"book","west"), "book_west") is not working, could any one help me on this?
thanks a lot.
You will have to use, what is called a lookarounds in regex. Try this regex for your search "^(?=.*\bbook\b)(?=.*\beast\b).*$"
. So your search will look like this
.... | eval products = case (match(shop_tags,"^(?=.*\bbook\b)(?=.*\beast\b).*$", "book_east")
This should give you an idea