I was trying to use eval with a case. Now I want to separate 2 different log messages, SENDNOW and SENDON. When I try using the eval case it captures both SENDNOW AND SENDON and I dont know why. Here is part of my query
Now all the events with ONETIMENOW and ONETIMEON are both being recorded under Send Now. Can anyone help me so that I can separate these two? I need to use wildcards because there is more data connected to both ONETIMENOW and ONETIMEON strings.
I'm not quite sure what you're trying to do. Maybe attach some more data will help clarify.
The eval case expression looks okay. It will assign the values "Send Now" and "Send on" to the field trans, based on the matched contents of field tt. If you want to filter the log messages after the case statement then you could use a where or search command. For example: