I have a search that is based on two events types - admin_login and admin_change. Admin_Login has two fields that the admin_change does not. Those fields are "admin_login_name" and "admin_login_email."
The fields, other than those two previously mentioned, are the same. What I'm looking to do:
If event_type=admin_login then admin_login_name = source_user_name AND admin_login_email = source_user_email.
Thanks in advance for the help.
| eval admin_login_name=if(event_type="admin_login",source_user_name,admin_login_name)
| eval admin_login_email=if(event_type="admin_login",source_user_email,admin_login_email)
Thank you very much. I definitely over thought this one.
| eval admin_login_name=if(event_type="admin_login",source_user_name,admin_login_name)
| eval admin_login_email=if(event_type="admin_login",source_user_email,admin_login_email)