hi i would like some help doing an eval function where based on 3 values of fields will determine if the eval field value be either OK or BAD
example these are the 4 fields in total (hostname, "chassis ready", result, synchronize)
hostname= alpha "chassis ready"=yes result=pass synchronize=no
hostname= beta "chassis ready"=yes result=pass synchronize=yes
hostname= charlie "chassis ready"=no result=pass synchronize=yes
i would like to do an eval for 'overallpass' where if ("chassis ready"=yes result=pass synchronize=yes) will make 'overallpass' = OK and everything else will be overallpass = 'Not Okay" by hostname
so based on the top table,
here is the final output.
*************************************
Hostname overallpass
alpha Not Okay
bravo OK
charlie Not Okay
Use this
| eval overallpass=if('chassis ready'="yes" AND result="pass" AND synchronize="yes", "OK", "Not Okay")
| stats values(overallpass) as overallpass by hostname
NB: The chassis ready must be surrounded by SINGLE quotes as eval needs to understand the space is part of the field name. The values must be double quoted.
Use this
| eval overallpass=if('chassis ready'="yes" AND result="pass" AND synchronize="yes", "OK", "Not Okay")
| stats values(overallpass) as overallpass by hostname
NB: The chassis ready must be surrounded by SINGLE quotes as eval needs to understand the space is part of the field name. The values must be double quoted.