Conditional search: How to use negative search in case command ?

[mxh7777]

Hi,

I got these datas

URI	TXT	Param
A	My text and others	param 1
A	My text and others	param 2
A	My text	param 3
A	My text	param 4
B	My text and others	param 2
B	My text	param 3
C	My text and others	param 1
C	My text	param4

I'd like to extract the datas according these rules :

- If URI = A, extract TXT that not contains "others"

- Else extract all

to obtain these results

URI	TXT	Param
A	My text	param 3
A	My text	param 4
B	My text and others	param 2
B	My text	param 3
C	My text and others	param 1
C	My text	param4

I don't know how to build my request.

I try to use "case" command like this but it return a logical error (Error in 'EvalCommand': The arguments to the 'like' function are invalid. ) :

...
|eval TXT=case(URI="A", NOT LIKE("%others%"), 1=1, "others")
...

How to use negative search in case command ?

Thanks

[richgalloway · Accepted solution]

The case function takes arguments in pairs.  The first half of the pair must be a boolean expression and the second half must be non-boolean.  It is this non-boolean value that is assigned to TXT.

The like function requires two aruments.  The first is a field name and the second is a SQL pattern to compare the field value against.  If the field value matches the pattern then the function returns true; otherwise, it returns false.

Perhaps you only need a where command to filter out the undesired events.

| where (URL!="A" OR (URL="A" AND NOT like(TXT, "%others%")))

[mxh7777]

Thanks

This better with "where"