I have one lookup in which there is a field which consist
TeamMember=(A1 OR A2) AND A4 AND A7 then print Aseries
TeamMember=(A1 OR A2) and A5 AND A6 then print Bseries
|eval Team=if((con1=="A1 OR con1=A2)"AND con1=="A4" AND con1=A7,Aseries,Other)
I used case as well but no luck.
based on the provided examples this will work:
| eval TeamMember="A1 A2 A3 A4 A5 A6 A7"
| makemv TeamMember
| mvexpand TeamMember
| eval Team = if((TeamMember="A1" OR TeamMember="A2") AND TeamMember="A4" AND TeamMember="A7", "foo" , "nope")
But, also based on your provided information this eval will never match anything because TeamMember has never at the same time either A1 or B2 and A4 and A7.
I would review either the use case or the events, because this based on the provided information will never work.
Hope this helps ...