How don't we nullify the data?

[danielbb]

A developer here wrote the following -

|eval admin_activity=if((like(cmd_data, "%audit%") AND like(cmd_data, "%start=%") AND NOT like(cmd_data, "%end=%")), "Login Attempt", NULL)
|eval admin_activity=if((like(cmd_data, "%audit%") AND like(cmd_data, "%start=%") AND like(cmd_data, "%end=%") AND isnull(admin_activity)), "Login Success", NULL)
|eval admin_activity=if((like(cmd_data, "%transaction%") AND isnull(admin_activity)), "Config Change", NULL)

We end up having admin_activity only as Config Change because the last eval nullifies the findings from the above two evals.

What can we do here?

[Sukisen1981]

hi @danielbb
You need to use a single eval

   |eval admin_activity=if((like(cmd_data, "%audit%") AND like(cmd_data, "%start=%") AND NOT like(cmd_data, "%end=%")), "Login Attempt", if((like(cmd_data, "%audit%") AND like(cmd_data, "%start=%") AND like(cmd_data, "%end=%") AND isnull(admin_activity)), "Login Success",if((like(cmd_data, "%transaction%") AND isnull(admin_activity)), "Config Change", NULL)))

[somesoni2 · Accepted solution]

Merge them in single eval-case , like this, so it stops overwriting value of admin_activity after first condition is true.

|eval admin_activity=case((like(cmd_data, "%audit%") AND like(cmd_data, "%start=%") AND NOT like(cmd_data, "%end=%")), "Login Attempt", (like(cmd_data, "%audit%") AND like(cmd_data, "%start=%") AND like(cmd_data, "%end=%") AND isnull(admin_activity)), "Login Success", (like(cmd_data, "%transaction%") AND isnull(admin_activity)), "Config Change", true(), null())