Eval Condition Search

[kpavan]

Hi,

Am looking for conditional eval search for my results, could you please help me with correct query.

index=myindex source="access" api="sendverification?email=*&op=passwordrecovery" OR api="*reset-password.html" OR api="*updatepassword" response_code=200 OR response_code=400
| eval API=case(api LIKE "%op=passwordrecovery", "Request Password Reset", api LIKE "%reset-password.html", "Email Link", api LIKE "%updatepassword", "updatepassword")
| chart count by API

but api=updatepassword has response_code 200(success) and 400(failure), i need to display api updatepassword, response_code 200 as success and api updatepassword, response_code 400 as failure

as result i need display all four api account with count like

Date, API, Count
2020-04-22, Request Password Reset, 10
2020-04-22, Email Link, 5
2020-04-22, Success, 9
2020-04-22, Failure, 1

Thanks!
Pavan

[manjunathmeti · Accepted solution]

hi @kpavan,

Try this.

index=myindex source="access" api="sendverification?email=*&op=passwordrecovery" OR api="*reset-password.html" OR api="*updatepassword" response_code=200 OR response_code=400
| eval API=case(like(api, "%op=passwordrecovery"), "Request Password Reset", like(api, "%reset-password.html"), "Email Link", like(api, "%updatepassword"), if(response_code == 200, "Success", "Failure"))
| chart count by API

[kpavan]

Thank you much @manjunathmeti !