Case with a multivalue field in calculated field not working

[wealot]

For CIM compliance I am trying to fill the action field from some logs using a case. This works in search but not in the calculated field, I see some others had similar issues but there has not been an answer on here. I am on Cloud so cannot directly change the confs, but calculated fields so far have been working fine.

Simple case statements that do not have multivalue fields with objects (e.g. category instead of entitis{}.remediationStatus) work as expected in calculated fields.

The events have a similar setup like this:

{"entities": [{"name": "somename"}, {"name": "other naem", "remediationStatus": "Prevented"}]}

Search (WORKS):

eval action=case('entities{}.remediationStatus'=="Prevented", "blocked", 'entities{}.deliveryAction'=="Blocked", "blocked", 'entities{}.deliveryAction'=="DeliveredAsSpam", "blocked", true(), "allowed")

Calculated field (Doesn't WORK):

action=case('entities{}.remediationStatus'=="Prevented", "blocked", 'entities{}.deliveryAction'=="Blocked", "blocked", 'entities{}.deliveryAction'=="DeliveredAsSpam", "blocked", true(), "allowed")

[wealot · Accepted solution]

It seems I made a mistake and kept the action= in the calculated field, which is why it didn't work.

Next to that while testing more it is important to wait for the test searches to time out of the caching or to change the searches.