I have the field called Error and if there is error we get error message if there is no error it will be empty
eg: Value for Error is E00000 duplicate key error
i have tried as below to add status if error thrown it is Failure else Success
| eval Status=case(len(Error)=='', "Success",len(Error)>0, "Failure")
It doesnt print Success in Status where there is not error (Error is empty) Message
i tried below:
| eval Status=case(isnull(Error), "Success",isnotnull(Error), "Failure")
it prints Success and Failure for Failure state
seems isnull satisfied for both the conditions. Please advise.
Can you please share example (sanitized) events, both success and failure? It may help us to see the full query, also.
"{\"ID\": \"123\", \"Testing\": \"5\"}"
"{\"ID\": \"123\", \"Error\": \"E11000 duplicate key\"}"
Please find sample data below:
First data, it should return Failure
"{\"ID\": \"123\", \"Testing\": \"5\"}"
"{\"ID\": \"123\", \"Error\": \"E00000 duplicate Error\"}"
Second data, it should return Success as not error here
"{\"ID\": \"1234\", \"Testing\": \"6\"}"
"{\"ID\": \"1234\", \"Designation\": \"Manager\"}"
i tried as below, but not working
| eval Status=case(isnull(Error), "Success",isnotnull(Error), "Failure")
| eval Status=case(len(Error)<0, "Success",len(Error)>0, "Failure")
The evals use the Error field, but have you confirmed the field exists? Please show the SPL prior to the eval.