I have a list of URLs in my website that is critical. So, I have marked all those URLs with a tag::critical using eventtype. However, I am unable to use tag field to filter data within the datamodel. So, I want to setup a field called content_priority that should have value of "critical" if the event has a critical tag , else set the field value to "normal".
I have configured a calculated field with following eval expression: if(tag=critical,"critical","normal")
However it does not seem to work at all. So, I am stuck with it now.
Any guidance would be much helpful and appreciated.