Label User IDs based on name

[Madmax]

index=gbts-vconnection * onEvent DISCONNECTED (host=Host1)
| rex field=_raw "(?ms)^(?:[^:\\n]*:){5}(?P<IONS>[^;]+)(?:[^:\\n]*:){8}(?P<Device>[^;]+)(?:[^;\\n]*;){4}\\w+:(?P<VDI>\\w+)" offset_field=_extracted_fields_bounds

This lists all Devices that have disconnected.  I'm trying to create a chart that lists only Macs, or Windows based on a key word like "mac" or "laptop"  in the Device name.  I tried using eval command but can't seem to get it working.  

[richgalloway]

What exactly did you try with the eval command?  How did the results not meet expectations?

To properly assist with a regex-related question, we need to see some example (sanitized) data.  Have you confirmed the regular expression works on regex101.com?  The "\\w+" constructs look like they should be something else (probably "\w+").

[Madmax]

Yes it absolutely has data.  I already have a full dashboard with disconnect data based on (IONS) User IDs, and Device names.  I am just stuck on this request to be able to filter the data by device type using keywords.  I don't think the eval command accepts wildcards like *mac* which I need.  Some Device names are for example "John-mac" others are "laptop-Mary", etc.  

I can get data using the following:

| stats count by "User ID"

| sort -count

but when I try using eval below it gives me nothing.  I can confirm that there is a Device named IPAD, Perhaps I should use another command but I'm fairly new at this.  Thank you! 

|eval DeviceType=case(Device=IPAD, "Macs", Device=Laptop, "Windows")
|stats count by Device, DeviceType

[richgalloway]

Again, without seeing sample data it's very difficult to determine why the search is not matching the data.

Try using quotes in the eval command

|eval DeviceType=case(Device="IPAD", "Macs", Device="Laptop", "Windows")

or use the match function to match an embedded string

|eval DeviceType=case(match(Device, "IPAD"), "Macs", match(Device, "Laptop"), "Windows")

[Madmax · Accepted solution]

Thank you for your help.  You got me on the right track.  While searching using that command I found another way to get what I was looking for by using the search command which I could then use wildcards to filter out what I need or don't need.    

This gave me all Windows devices:

|search Device=*DESKTOP* OR *laptop* OR *lenovo* OR *dell* OR *HP*| stats dc("IONS") as total_users

This listed all devices besides what I was looking for:

| search NOT Device IN (*LAPTOP*,*Desktop*,*lenovo*,*dell*,*HP*,*MAC*,*Ipad*,)
| stats dc("IONS") as total_users