Eval a field twice based on index name

[bleung93]

I have a field totalVolumeGB thats value is based on the eval below. I want to eval the same field, but with a filter based on the index field.

The index field is essentially index=*.

... | eval totalVolumeGB=10*(homePath_maxDataSizeMB+coldPath_maxDataSizeMB)/1024

I want to add this to the previous query, when my "index=summary_*"

... | eval totalVolumeGB=23*(homePath_maxDataSizeMB+coldPath_maxDataSizeMB)/1024

[aelliott]

how about something like this:
... | eval num=if(like(index,"summary_%"),23,10) | eval totalVolumeGB=num*(homePath_maxDataSizeMB+coldPath_maxDataSizeMB)/1024

[somesoni2 · Accepted solution]

try this

   ... | eval totalVolumeGB=if(like(index,"summary_%"),23*(homePath_maxDataSizeMB+coldPath_maxDataSizeMB)/1024,10*(homePath_maxDataSizeMB+coldPath_maxDataSizeMB)/1024) | ...

OR

... | eval totalVolumeGB =(homePath_maxDataSizeMB+coldPath_maxDataSizeMB)/1024| eval totalVolumeGB=if(like(index,"summary_%"),23*totalVolumeGB ,10*totalVolumeGB ) | ...

[somesoni2]

Thanks @aelliott for pointing it out. corrected now.