Can you validate an eval with an input?

[AzySidhe]

I have a search that takes all enquiry and certain application response times and then counts them to display how many transactions are between 20 and 60 seconds and how many have exceeded 60 seconds. The problem that I'm facing is that I have an extraction on the Application field. This causes any applications connected to the enquiries to also be counted.

What I'm trying to do is use the list of applications from the lookup to eval JUST those applications. I tried it as a subsearch and appending the results together but it ran too slowly and would only return partial results as it would timeout.

PSEUDOSEARCH:

host=<hostname> source=<sourcename> [inputlookup Application.csv | fields Application | rename Application AS APPLICATION] OR REQUESTTYPE=Enq    uiry | stats count(eval((TIME_TOTAL >= 20000) AND (TIME_TOTAL < 60000) AND REQUESTTYPE=Enquiry)) As "ENQ - SLOW", count(eval(TIME_TOTAL >= 60000 AND REQUESTTYPE=Enquiry)) As "ENQ - TIMEOUT", count(eval((TIME_TOTAL >= 20000) AND (TIME_TOTAL < 60000) AND APPLICATION=<list of applications>)) As "APP - SLOW", count(eval(TIME_TOTAL >= 60000 AND APPLICATION=<list of applications>)) As "APP - TIMEOUT" | transpose | rename column As "Type", "row 1" As "count"

OUTPUT:
Type-----------------------------------count
ENQ - SLOW ------------------------130
ENQ - TIMEOUT--------------------25
APP - SLOW -------------------------80
APP - TIMEOUT---------------------6

Any help would be wonderful!

[somesoni2 · Accepted solution]

Try something like this. One ground work before this should, identity/add a field to Application.csv lookup table which is not present in the events. This is require to uniquely identify events which have APPLICATION present in the lookup Application.csv. I assume that field name is flag and flag has value "Y" for all rows in the lookup table.

 host=<hostname> source=<sourcename> [| inputlookup Application.csv | fields Application | rename Application AS APPLICATION] OR REQUESTTYPE=Enquiry | lookup Application.csv Application as APPLICATION OUTPUT flag | eval Type=case(TIME_TOTAL >= 20000 AND TIME_TOTAL < 60000 AND REQUESTTYPE=Enquiry, "ENQ - SLOW",TIME_TOTAL >= 60000 AND REQUESTTYPE=Enquiry, "ENQ - TIMEOUT",TIME_TOTAL >= 20000 AND TIME_TOTAL < 60000 AND flag="Y", "APP - SLOW" ,TIME_TOTAL >= 60000 AND flag="Y", "APP - TIMEOUT" ) | stats count by Type

[AzySidhe]

This fixed the issue for me. Thank you so much!