Could you help me with the syntax for an "IF/THEN" and "IF/ELSE" search?

[Mohsin123]

Hi ,

i want a syntax for this:

if Response_time>3000 then Response_time="gt3SEC"
else if Response_time>1000 and Response_time<3000 then Response_time="bet1-3Sec"
else if Response_time<1000 then Response_time="lt1Sec"

Please help

[kamlesh_vaghela]

@Mohsin123

Can you please try this?

YOUR_SEARCH
| eval A=case(Response_time<1000,"lt1Sec",Response_time>=1000 AND Response_time<=3000,"bet1-3Sec",Response_time=3000,"gt3SEC")

Sample Search

|makeresults 
| eval Response_time=3000 
| eval A=case(Response_time<1000,"lt1Sec",Response_time>=1000 AND Response_time<=3000,"bet1-3Sec",Response_time=3000,"gt3SEC")

[Mohsin123]

Hi,

this is working :
|makeresults
| eval Response_time=3000
| eval A=case(Response_time<1000,"lt1Sec",Response_time>=1000 AND Response_time<=3000,"bet1-3Sec",Response_time=3000,"gt3SEC")

in an independent search but not working with my search ....
........
| eval Response_time=case(Response_time<1000,"lt1Sec",Response_time>=1000 AND Response_time<=3000,"bet1-3Sec",Response_time=3000,"gt3SEC")

[kamlesh_vaghela]

@Mohsin123

Can you please replace your value in my sample search and execute?

|makeresults 
| eval Response_time=<<REPLACE_YOU_VALUE>> 
| eval Response_time=case(Response_time<1000,"lt1Sec",Response_time>=1000 AND Response_time<=3000,"bet1-3Sec",Response_time=3000,"gt3SEC")

OR

Can you please share the sample output of your search? So I can work on it.

YOUR_SEARCH | table Response_time | head 5

[paulbannister]

Hi There,

I'm assuming that you have already created the field "Response_time" prior to the case statement? What isse are you running into with the search?

[paulbannister]

Hi There,

You may want to try a case statement for this, unless there are any other variables you need to create:

|eval FIELDNAME=case(Response_time>3000, Response_time="gt3SEC", Response_time>1000 AND Response_time<3000, Response_time="bet1-3Sec", Response_time<1000, Response_time="lt1Sec")

[Mohsin123]

i am getting this error

Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr]).

[paulbannister]

Apologies, try this:

|eval Response_time=
case(Response_time>3000, "gt3SEC", Response_time>1000 AND Response_time<3000, "bet1-3Sec", Response_time<1000, "lt1Sec")