How to include two 'like' eval expressions in splunk

[gilbxrtx_7]

I am working on eval expression. I have a set of data and I want to evaluate a field such that I only extract login authentication messages.
The following search string helps to extract only logins:
| eval logins=if(like(message,"Login%"),"is_login","is_not_login")
is_login :84 events (failed and successful login events)
is_not_login: 551 events (all other events)
I would like to create a second eval expression where I zoom in on "is_login" field and further split the values into two.
|eval action=if(like(is_login,"Login failed%"),"Failure","Success")
No Failure value in 'action' field.
Success: 635 events (whole log file events)
I expect to get a field 'action' with two values within it, Failure and Success. However I only get one Success value which represents all events from the log file itself.

Combined eval search:
| eval logins=if(like(message,"Login%"),"is_login","is_not_login") |eval action=if(like(is_login,"Login failed%"),"Failure","Success")

I need help to see if my logic is correct, the first eval seperates login events from all other events, the second eval further divides the failed and successful login events.

[richgalloway]

The first eval loses the the original text in 'message'. Later evals need to refer to 'message' as well. Try this:

| eval logins=if(like(message,"Login%"),"is_login","is_not_login") | eval action=case(like(message,"Login failed%") AND logins=="is_login", "Failure", NOT like(message,"Login failed%") AND logins=="is_login", "Success", 1=1, "")

[p_gurav]

Logins has two values is_login and is_not_login. So in second event you cant perform eval on values, "like" function work on fields not on values.