How do I edit my "eval if match" syntax to evaluate complex combinations with precedence on the order of operation?

[jclemons7]

Hello all,

I have the following eval function which functions properly:

| eval my_count=if(match(lower(FieldName),"\\\filename.exe"),1,0)

But I want to evaluate a few things in the if statement and need them to have precedence on the order of operation. What I'd like to be able to say is if FieldName contains \filename.exe OR (bob AND uncle) then 1, else 0, but for the life of me, I can't get the expected results.

Any help is greatly appreciated.

[richgalloway]

Here's a run-anywhere example.

|metadata type=sources | head 1 | eval FieldName="filename.exe" | eval bob=1 | eval uncle=1 | eval my_count=if(match(lower(FieldName),"\\\filename.exe") OR (bob==1 AND uncle==1),1,0) | table FieldName bob uncle my_count