I have one lookup in which there is a field which consist
Team Member
A1
A2
A3
A4
A5
A6
A7
Now,If
TeamMember=(A1 OR A2) AND A4 AND A7 then print Aseries
TeamMember=(A1 OR A2) and A5 AND A6 then print Bseries
I tried |eval Team=if((con1=="A1 OR con1=A2)"AND con1=="A4" AND con1=A7,Aseries,Other)
I used case as well but no luck.
Maybe like this:
Your Base Search Here
| appendpipe [|inputlookup TeamMember.csv | stats values(TeamMember) AS con1]
| eval Team=if(((con1=="A1" OR con1=="A2") AND con1=="A4" AND con1=="A7"), "Aseries", "Bseries")
Maybe like this:
Your Base Search Here
| appendpipe [|inputlookup TeamMember.csv | stats values(TeamMember) AS con1]
| eval Team=if(((con1=="A1" OR con1=="A2") AND con1=="A4" AND con1=="A7"), "Aseries", "Bseries")
Try this:
| eval Team= if((con1== "A1" OR con1=="A2") AND con1=="A4" AND con1="A7", Aseries, Other)
@kumagaur ,
Do you have multiple values of con1 in a single event ? If not AND condition will not work. Do you have some sample events ?