How to edit my search to add a third column to my table results if there are certain values in the first

[athorat]

I want to add a column "FinalType" in a statistical table, so when the EventType=ScoreLock and TxnType=Renewal, it should show the value "Scorelock" in the FinalType column. The results should look like this:

EventType           TxnType              FinalType

ScoreLock           Renewal              ScoreLock  
Bind                 Endorsement          Exception     
Renewal Offer       Renewal           EUBI

I am currently using this search to display these results:

index="np_dpa" sit-api-monitor  EventType="[request]" OR EventType="[error]"  PROXYNAME="mpgw_RecordUBIVehicleScore"|stats count by eventType transactionType 

[somesoni2 · Accepted solution]

How about this

index="np_dpa" sit-api-monitor EventType="[request]" OR EventType="[error]" PROXYNAME="mpgw_RecordUBIVehicleScore"|stats count by eventType transactionType  | eval FinalType=case(eventType="ScoreLock" AND transactionType="Renewal","ScoreLock",eventType="Bind" AND transactionType="Endorsement","Exception",1=1,"EUBI")