Create static fields after matching the field value

[RSS_STT]

I want to create one static field by looking status value = Issue

host	m_nname	status
A	cpu	Ok
B	disk	Ok
C	memory	Issue
D	netwok	Ok
E	storage	Issue

Issue found in status column few field heath created with Bad value.

Like below.

host	m_nname	status	Health
A	cpu	Ok	Bad
B	disk	Ok	Bad
C	memory	Issue	Bad
D	netwok	Ok	Bad
E	storage	Issue	Bad

[PickleRick]

It's not clear how the health field is calculated. One way is what @ITWhisperer showed but it won't match your mockup results - you have health=bad all acros the board.

[ITWhisperer]

Are you saying that you want a health field that has "Bad" in for all the events if any of the events have status="Issue"?

[RSS_STT]

Yes, Your understanding is correct.

[ITWhisperer]

| eventstats values(eval(if(status="Issue","Bad",null()))) as Health

[RSS_STT]

It's missing the fields value if all Ok. 

I need Health field to be populated with Ok if all status field have all Ok value.

[ITWhisperer · Accepted solution]

| eventstats values(eval(if(status="Issue","Bad",null()))) as Health
| fillnull value="Ok" Health

[richgalloway]

Use the eval command to create a field.

| eval Health = if(status="Issue", "Bad", "Ok")