Add a new field/table column with preset data (conditional)

[phamxuantung]

I'm extracting data from a raw log and put it on a table, now I want to add a column that indicate the action that admin should take if a port is downed, it's kind of like this

Time|System|Domain|Status    |Action
--------------------------------
XXX |XXX   |XXX   |DOWN      |Call IT
XXX |XXX   |XXX   |infiltrate|Call Security

In here, the Action field/column is a newly created data that not in the raw log but generated based on the Status's value, like "Call IT" if the Status is DOWN, or "Call Security" if Status is Infiltrate.

Is there anyway to archive this?

[scelikok · Accepted solution]

Hi @phamxuantung,

You can create Action field based on Status fields adding below eval command;

| eval Action=case(Status="DOWN","Call IT",Status="infiltrate","Call Security")

If this reply helps you an upvote is appreciated.

[phamxuantung]

Thank you, that's exactly what I need