I have a message in my events like below
"Main function executed successfully."
I need to change status of the above message to Success status.
Also you can try this ;
| eval status = if(match(_raw,"Main function executed successfully. "),"Success","No Sucess Message")
Do you mean to assign a value to a field named "status"? Like
| eval status = if(match("Main function executed successfully", "Success", null())