EVAL statement not correct

[davidcraven02]

My eval statement below is to check if 'Action is Required' only if the below conditions are met, I have also used case and if statement to determine this, however none of these have worked.

1. Location does not equal Varonis (i.e equals Not in Varonis)
2. MonitoringStatus does not equal Monitored (i.e equals Not Monitored)

3. Contains the word "Hosting" in the Path field

   | eval VaronisStatus=if(('(g)Location'!="Varonis" AND(MonitoringStatus!="Monitored") AND like(Path,"%Hosting%")),"Action Required", "No Action Required")

   || eval VaronisStatus=case(('(g)Location'!="Varonis" AND(MonitoringStatus!="Monitored") AND like(Path,"%Hosting%")),"Action Required" , 1=1,"No Action Required")

[elliotproebstel]

Both of your approaches work on my system with test events. I don't see any functional difference between your first approach and the one suggested by @mayurr98 below, but if it works for you, great. If it doesn't, can you share some sample events that are being incorrectly categorized?

[clara-fication]

when i run this:

|makeresults|eval "(g)Location"="Varonis" |eval MonitoringStatus="notMonitored"|eval Path="Hosting"| eval VaronisStatus=if(('(g)Location'!="Varonis" AND (MonitoringStatus!="Monitored") AND like(Path,"%Hosting%")),"Action Required", "No Action Required")

i get "No Action Required" and when i change the (g)Location to notVaronis, I get Action Required

what exactly isn't working with this?

[mayurr98]

try this run anywhere search

|makeresults|eval "(g)Location"="Varonis" |eval MonitoringStatus="NotMonitored"|eval Path="Hosting"| eval VaronisStatus=if('(g)Location'!="Varonis" AND MonitoringStatus!="Monitored" AND like(Path,"%Hosting%"),"Action Required", "No Action Required")

you should try

| eval VaronisStatus=if('(g)Location'!="Varonis" AND MonitoringStatus!="Monitored" AND like(Path,"%Hosting%"),"Action Required", "No Action Required")

let me know if this helps !