Correct syntax of eval string case

[itnewbie]

I have a "Severity Level" field in both index A and index B.

Their structure is like:

==index A===
Severity Level
1
2
3
4

===index B===
Severity Level
critical
high
medium
low

 Now I want to combine the two indexes in a search and display the Severity Level using 

| timechart count by "Severity Level"

where the combined "Severity Level" values only contain 1,2,3,4

So, I need an eval = case() to map them.

My syntax for for that is 

eval "Severity Level" = case('Severity Level' == "critical", 1 ,'Severity Level' == "high", 2, 'Severity Level' == "medium", 3, 'Severity Level' == "low", 4, 'Severity Level' == 1, 1, 'Severity Level'  == 2, 2, 'Severity Level'  == 3, 3, 'Severity Level'  == 4, 4, 1=1, null)

 By this, the result gives incorrect result, i.e., only showing incorrect counts on 4. I think the problem is in the single and double quote, but I am not sure which is which. It is a bit urgent so I need help. Thanks. 

[jotne]

A small tip:

| makeresults 
| eval "Severity Level"=split("1,2,3,4", ",") 
| mvexpand "Severity Level" 

Can also be created like this:

| makeresults count=4
| streamstats count as "Severity Level"

[bowesmana · Accepted solution]

There doesn't appear to be anything functionally wrong with the case. With eval, you MUST use single quotes to wrap field names on the RIGHT hand side of the eval, whereas double quotes are used on the LEFT hand side, i.e.

| eval "Severity Level" = case('Severity Level'...)

As you have

This shows your eval is correct

| makeresults 
| eval "Severity Level"=split("1,2,3,4", ",") 
| mvexpand "Severity Level" 
| append 
    [| makeresults 
    | eval "Severity Level"=split("critical,high,medium,low", ",") 
    | mvexpand "Severity Level"
        ] 
| fields - _time 
| eval "Severity Level" = case('Severity Level' == "critical", 1 ,'Severity Level' == "high", 2, 'Severity Level' == "medium", 3, 'Severity Level' == "low", 4, 'Severity Level' == 1, 1, 'Severity Level' == 2, 2, 'Severity Level' == 3, 3, 'Severity Level' == 4, 4, 1=1, null)

but you could just do

| eval "Severity Level" = case('Severity Level' == "critical", 1,
                               'Severity Level' == "high", 2, 
                               'Severity Level' == "medium", 3, 
                               'Severity Level' == "low", 4, 1==1, 'Severity Level')

as the final case statement is just saying that it will take the value of Severity Level - unless you may have some other value.