Is it possible to do something like this? It would make my life a whole lot easier if this can be done, or at least something like it...
eval if(((TimeTaken>15) AND ((Termination_Cause=="016") OR (Termination_Cause=="017"))),1,0)
When I try it I get an error stating that the expression is malformed. Any advice is appreciated.
You're not far off
eval foo=if((TimeTaken>15) AND (Termination_Cause=="016" OR Termination_Cause=="017"),1,0)
You should probably post your whole search, there are might be some extra parenthesis in there.
Note that eval takes the form:
eval <my_field> = <my_eval_expression>
Also, I think you can use searchmatch() here more efficiently:
eval case=searchmatch("TimeTaken>15 AND (Termination_Cause="16" OR Termination_Cause="17")")
If case=true, then the event matches the condition.