Hi ,
I have a search query -
| search Region = EMEA
| eval Status=case(Statistic=0,"Green" ,
Statistic=2,"Red",
Statistic=1,"Blue",
1==1, " " )
| appendpipe [ stats count | eval Status="Black" | where count=0 | fields - count]
| stats latest(Status)
The region has 7 SOD status data i.e. red and green. ,The issue is if one sod is in red state it is still showing green status.
What I require is even if there is a single red status it has to be picked and not the green one , as I am using it in a dashboard.
case function is evaluated left to right, so put your highest priority condition first
| eval Status=case(Statistic=2,"Red",
Statistic=1,"Blue",
Statistic=0,"Green" ,
1==1, " " )
Tried it , but still its showing green
Please share some sample events (anonymised as necessary) in a code block </> so we can see what you are dealing with.