- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Is it possible to have the true and false parts of an if statement contain eval statements.
| eval pwdExpire=if(type="staff", | eval relative_time(_time, "+90day") , | eval relative_time(_time, "+180day") )
Desired results is:
If type="staff" calculate pwdExpiry as _time + 90 days, else calculate pwdExpiry as _time + 180 days.
I will then format pwdExpiry and display in a table.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

The following should do what you want:
| eval pwdExpire = if(type="staff", strftime(relative_time(_time, "+90d"),"%F %T"), strftime(relative_time(_time, "+180d"),"%F %T") )
You may need to adjust the time format (I've used %F %T) to suit your requirements.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

The following should do what you want:
| eval pwdExpire = if(type="staff", strftime(relative_time(_time, "+90d"),"%F %T"), strftime(relative_time(_time, "+180d"),"%F %T") )
You may need to adjust the time format (I've used %F %T) to suit your requirements.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

One additional remark about time manipulation - don't render it to a string unless you are absolutely sure you won't be doing anything else with it. And even better - don't render the _value_ to a string - leave the value in an epoch timestamp but use fieldformat command to only display it rendered to a string.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Perfect @chris_barrett . Thanks for the response.
