AND OR not working correctly

[davidcraven02]

I am getting the below error when trying to form an AND & OR in my query.

Error in 'eval' command: The expression is malformed. Expected ).

My eval is below:

| eval Action=if((MonitoringStatus="Not Monitored") AND(like(Path,"%Hosting%") 
 AND Location="Varonis" 
 OR(7DayBackUpStatus="Not Backed Up") "Action Required","No Action Required") 

[mayurr98]

Hey

Try this !

 | eval Action=if(((MonitoringStatus="Not Monitored") AND (like(Path,"%Hosting%")) AND Location="Varonis" OR  '7DayBackUpStatus'="Not Backed Up"), "Action Required", "No Action Required")

Let me know if this helps you !

[davidcraven02]

Sorry I marked this accepted prematurely. it doesn't seem the OR statement is kicking in as there are more than 50 rows of data that are listed as 'Not Backed Up'

[micahkemp]

I've updated my answer to also take into consideration two alternate searches (grouped AND/OR with parentheses to make it more clear) that may correct your logic issue as well.

[mayurr98]

I do not know how to deal with fieldname starting with a number i may be wrong
Can you change the fieldname to sevendaybackupstatus

  | eval Action=if(((MonitoringStatus="Not Monitored") AND (like(Path,"%Hosting%")) AND Location="Varonis" OR  sevendaybackupstatus="Not Backed Up"), "Action Required", "No Action Required")

OR

Try this

 | rename “7DayBackUpStatus” as sevendaybackupstatus | eval Action=if(((MonitoringStatus="Not Monitored") AND (like(Path,"%Hosting%")) AND Location="Varonis" OR  sevendaybackupstatus="Not Backed Up"), "Action Required", "No Action Required")

[micahkemp]

The field name that starts with the number 7 needs to be in single quotes:

| eval Action=if(
    (MonitoringStatus="Not Monitored")
    AND (
        like(Path,"%Hosting%")
        AND Location="Varonis" 
        OR  '7DayBackUpStatus'="Not Backed Up"
    ), "Action Required", "No Action Required")

I suggest putting parentheses when you mix AND and OR. I'm not sure what your intent might be, but you may consider one of these variants:

| eval Action=if(
    (MonitoringStatus="Not Monitored")
    AND (
        (like(Path,"%Hosting%") AND Location="Varonis")
        OR  '7DayBackUpStatus'="Not Backed Up"
    ), "Action Required", "No Action Required")

| eval Action=if(
    (MonitoringStatus="Not Monitored")
    AND (
        like(Path,"%Hosting%")
        AND (Location="Varonis" OR '7DayBackUpStatus'="Not Backed Up")
    ), "Action Required", "No Action Required")

[somesoni2]

Try this (you're missing a closing braces on conditions and command before "Action Required")

| eval Action=if((MonitoringStatus="Not Monitored") AND 
( like(Path,"%Hosting%")  AND Location="Varonis" OR (7DayBackUpStatus="Not Backed Up")),  "Action Required","No Action Required")