Hi,
I am trying to use case keyword to solve a multiple nested statement but it is just giving me output for the else value, it seems like it is not going inside any other statement to check, Could anyone please help me here. I tired using multiple if statement with eval still I was having the same issue.
Problem statement : I want to compare the value of status-fail and status-success and on the basis of that we need to generate the output
case1 : if value of status-fail =0 and status-success>0 ---> successful logins
case2: if value of status-fail >0 and status-success>0 ---> multi-successful logins
case3: if value of status-fail >0 and status-success=0 ---> multi-fail
case4: if value of status-fail >0 ---> fail logins
Below is the query what I am using :
table hqid, httpStatus | eval status-success=if(httpStatus="200",1,0) | eval status-fail= if(httpStatus != "200",1,0)
| stats sum(status-success) as status-success, sum(status-fail) as status-fail by hqid | eval status = case(status-fail = 0 AND status-success > 0, "successful-logins", status-fail > 0 AND status-success > 0, "multi-success", status-fail > 0 AND status-success=0, "multi-fail", status-fail > 0, "fail",1=1,"Others")
Thank you , its working now.
Try putting the field names with hyphens in in single quotes - something like this (or use fieldnames without hyphens!)
table hqid, httpStatus | eval status-success=if(httpStatus="200",1,0) | eval status-fail= if(httpStatus != "200",1,0)
| stats sum(status-success) as status-success, sum(status-fail) as status-fail by hqid | eval status = case('status-fail' = 0 AND 'status-success' > 0, "successful-logins", 'status-fail' > 0 AND 'status-success' > 0, "multi-success", 'status-fail' > 0 AND 'status-success'=0, "multi-fail", 'status-fail' > 0, "fail",1=1,"Others")