How do I match based on multiple values using eval and like command

[ezmo1982]

Hi,

I have a field named operating_system. it can contain multiple values examples being "Windows 10", "Windows Server 2016", "Windows 7" and others.

I want to set a field named os_group based on the value of operating_system. So if the value operating_system value contains "Windows Server*" i want to set the os_group to "Server". If the value of operating_system is "Windows 7", "Windows 8", or "Windows 10", I want to set os_group to "Workstation"

I was trying to do it using seperate lines as below. But can i combine these into one eval function where i can specify multiple values to filter on? I will need to use wildcards.

| eval os_group=if(like(operating_system, "%Server%", "Server", os_group)
| eval os_group=if(like(operating_system, "%Windows 7%", "Workstation", os_group)

Thanks

[scelikok]

Hi @ezmo1982,

You can use case statement;

| eval os_group=case(like(operating_system, "%Server%", "Server",like(operating_system, "%Windows 7%", "Workstation", 1=1, os_group)

[ezmo1982]

Missing a ")" at the end of "%Server%" but apart from your spl does the job, thanks!