- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
My field has following value
summary="java running in chrome"
I need a search such that summary should have the word "java" and shouldn't have "chrome", "firefox".
My search is :
|eval Application = case(Summary like "%Java%" NOT "%chrome%" NOT "%firefox%","Java",Summary like "%flash%","flash")
but it is not working. Can anyone guide me?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

NOT keyword in not supported for case statement, so use ! instead for performing not expression.
|eval Application = case(Summary like "%Java%" AND ! ( Summary like "%chrome%" OR Summary like "%firefox%"),"Java",Summary like "%flash%","flash")
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Try something like this
your current search
|eval Application = case(match(Summary,"Java") AND NOT (match(Summary,"chrome") OR match(Summary,"firefox")), "Java" ,match(Summary,"flash"),"flash", true(),"other")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

NOT keyword in not supported for case statement, so use ! instead for performing not expression.
|eval Application = case(Summary like "%Java%" AND ! ( Summary like "%chrome%" OR Summary like "%firefox%"),"Java",Summary like "%flash%","flash")
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
not working 😞
getting the following error.
Typechecking failed. 'OR' only takes boolean arguments.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

I have edited my answer as I was missing Summary like conditions in the not condition. Can you please retry the above and confirm?
| makeresults | eval message= "Happy Splunking!!!"
