How could I get multiple result when using "case"?

[Questioner]

I want to show this requirement in splunk.

• when year<="2020" &&  time_type = "ALL" make variable "day_type" must have "day"
• when year>"2020" &&  time_type = "ALL" make variable  "day_type" can have "day" and "night"
• when time_type="half" make variable "day_type" must have "morning"

So, I wrote my code like this, but it doesn't working at all.

where day_type = case("$time_type$"=="ALL", case("$year$"<="2020", "day",1=1, in("day","night")), "$time_type$"=="half", "morning", 1=1,day_type)

 How could I make this Requirement ??

[Manasa_401]

Hi @Questioner 

First using an eval create a day_type field with the conditions and next you can use where command to filter for the day_type you need.

| eval day_type=case(time_type="ALL" AND year<=2020,"day",time_type = "ALL" AND year>2020,"day night",1=1,"morning")
| where like(day_type,"%day%")

 You can pass the token in where command

If this answer helps, an upvote would be appreciated.

[Questioner]

But it cound not recognized " like(day_type, "%day")"
It said the expression is malformed.😢

[ITWhisperer · Accepted solution]

Are you trying to filter your events based on the values in these fields?

| where (year<=2020 AND time_type=="ALL" AND day_type=="day") OR (year>2020 AND time_type="ALL" AND (day_type=="day" OR day_type=="night")) OR (time_type=="half" AND day_type=="morning")

[Questioner]

I never thought of it this way.

Thank you for your information!!