What does "it's not working" mean? What do you get for X and Y?
.... my search | eval divide=case(D<=8000,”Y”,D>8000,”X”) | stats count by divide
Let me know if this helps!
Hey @mayurr98, it didn't work.
I got the following error
Error in 'eval' command: The expression is malformed. An unexpected character is reached at '”Y”,D>8000,”X”)'.
Do you want these as separate fields or as one field with two values?
To create one field with two values:
...| eval two_parts=if(D<=8000,”Y”,”X”)...
To get separate fields:
...|eval Y=if(D<=8000,D,null())|eval X=if(D>8000,D,null())...
The other answers look like they will accomplish what you want, but in terms of the syntax you started with I wonder if you're looking for this:
stats count(eval(D<=8000)) AS Y, count(eval(D>8000)) AS X