EVAL for multiple conditions check

[davidcraven02]

I have a search which checks if the values within con_splunkUL exist within con_UL (or visa versa).

I need a field created called "Action" which checks this and also if the word "Hosting" exists in the Path field. If this is met then value should be 'Action Required' and if not then 'No Action Required'

search source="otl_varonis_monitoring.csv" host="opspksh01d.options-it.com" sourcetype="csv" type=Production 
        | eval con=machine. "," .drive 
        | eval con_UL = upper(con)] 
    | eval MonitoringStatus = if(like(con_splunkUL,"%".con_UL."%"), "Monitored", "Not Monitored") 
    | eval drive = Path 
    | rex field=drive "(?P<Drive>\w+)\:" 
    | dedup machine, Drive, Path, MonitoringStatus 
    | table machine, Drive, Path, MonitoringStatus, type

[493669]

@davidcraven02 Can you try below:

eval Action=if ((MonitoringStatus="Monitored")AND(like(Path,"%Hosting%")),"Action Required","No Action Required")