IF statement unable to pickup up from field

[krish3]

Below is my query to separate priority accounts of AD based on group name but I am unable to assign any priority based on groups...

|ldapsearch domain=domain.com search="(&(objectclass=user)(!(objectClass=computer)))"
|makemv userAccountControl
|search userAccountControl="NORMAL_ACCOUNT" 
|eval priority=if(memberOf="Executive Account","high","medium")|stats count by priority

And also i would like to mention that below search gives me results without if condition

|ldapsearch domain=domain.com search="(&(objectclass=user)(!(objectClass=computer)))"
|makemv userAccountControl
|search userAccountControl="NORMAL_ACCOUNT" 
|search "Executive Accounts"

Also please let me know if any other alternative queries for importing the identities to ES App based on group wise priority.

Thanks,

[esix_splunk]

I do believe memberOf is a multivalue (or can be) field. So matching in the case of multiple group memberships will have some difficulty here.

[krish3 · Accepted solution]

Hey Guys,

Thanks. I was able to make it work using like function of eval command.

But still not sure why it was not able work on using field=value condition