How to build a search using 4 different ad hoc searches

[svemurilv]

base-search earliest=-1h@m|
Desk
cli_attr="MOBILE_IND=N"

Mobile
cli_attr="MOBILE_IND=Y"

Emarketing
cli_attr="MOBILE_IND=Y" OR cli_attr="MOBILE_IND=N" PartnerCode=*

Non-Emarketing
cli_attr="MOBILE_IND=Y" OR cli_attr="MOBILE_IND=N" NOT PartnerCode=*

using these am trying to build a base search

|eval deskdev=if(cli_attr=="MOBILE_IND=N","MOBILE_IND=N",NULL)
|eval mobiledev=if(cli_attr!="MOBILE_IND=N","MOBILE_IND=N",NULL)
|eval eMarketing=if((cli_attr=="MOBILE_IND=Y") OR (cli_attr!="MOBILE_IND==Y") AND (PartnerCode=="") , "MOBILE_IND=Y",NULL)
|eval NoneMarketing=if((cli_attr=="MOBILE_IND=Y") OR (cli_attr!="MOBILE_IND=Y") AND (PartnerCode!=""),"MOBILE_IND=Y",NULL)

search not able to match the values with original, how would it possible.

[woodcock]

Like this:

base-search earliest=-1h@m
| stats count(eval(searchmatch("cli_attr=\"MOBILE_IND=N\""))) AS deskdev
        count(eval(searchmatch("cli_attr=\"MOBILE_IND=Y\""))) AS mobiledev
        count(eval(searchmatch("cli_attr=\"MOBILE_IND=Y\" OR cli_attr=\"MOBILE_IND=N\" PartnerCode=\"*\""))) AS eMarketing
        count(eval(searchmatch("cli_attr=\"MOBILE_IND=Y\" OR cli_attr=\"MOBILE_IND=N\" NOT PartnerCode=\"*\""))) AS NoneMarketing

It is hilarious but probably won't fly for you to call Non-eMarketing by None Marketing, kind of like a psychologist using therpaist.com.

[s2_splunk]

This should work. I recommend using null() instead of NULL, but that's not your issue.
Can you provide a sample event? Are you sure your field contents in the events are present and have the exact value you are looking for?

This run-anywhere search validates that your query is correct: | makeresults | eval cli_attr="MOBILE_IND=N" | eval deskdev=if(cli_attr=="MOBILE_IND=N","MOBILE_IND=N",null())

[svemurilv]

Am good with the Desktop and Mobile , but am not sure how to write the |eval condition for Emarketing and NonEmarketing. where i struck

[s2_splunk]

This part (cli_attr=="MOBILE_IND=Y") OR (cli_attr!="MOBILE_IND==Y") makes no sense (it's always true), you may as well leave it out and just use PatnerCode

[svemurilv]

missing these ?

Emarketing
cli_attr="MOBILE_IND=Y" OR cli_attr="MOBILE_IND=N" PartnerCode=*

Non-Emarketing
cli_attr="MOBILE_IND=Y" OR cli_attr="MOBILE_IND=N" NOT PartnerCode=*

[s2_splunk]

What values can cli_attr have other than MOBILE_IND=Y and MOBILE_IND=N?

Maybe we can help better if you verbally describe the conditions you want to test for and the resulting values for the eval'ed target field, as I am not clear on what you want your outcome to be.

[svemurilv]

here in the the search we have included a PartnerCode=* and NOT PartnerCode=* there 2 are the differences between emarketing and nonemarketing we should include that part also in the same |eval If condition for each