How to get each where statement just to run the EVAL command that is right under the where statement?

[pjon8allstate]

I have code

| eval m=case(minute>0 AND minute<15,15,minute>14 AND minute<30,15,minute>29 AND minute<45,30,minute>44,45)
| eval where m = "00"
| eval time1=strftime(_time, "%Y-%m-%d %H:00:00")
| eval where m = "15"
| eval time1=strftime(_time, "%Y-%m-%d %H:15:00")
| eval where m = "30"
| eval time1=strftime(_time, "%Y-%m-%d %H:30:00")
| eval where m = "45"
| eval time1=strftime(_time, "%Y-%m-%d %H:45:00")
| table system SMF30JBN _time SMF30SRV msused hour m time1

How do I get each where statement just to run the EVAL command that is right under the where statement

Right now ever time ends up with 45 in the minute place 

[richgalloway]

The where command filters events.  I think you really just need another case statement.

| eval m=case(minute>0 AND minute<15,15,minute>14 AND minute<30,15,minute>29 AND minute<45,30,minute>44,45)
| eval time1=case(m = "00",strftime(_time, "%Y-%m-%d %H:00:00"),
                  m = "15",strftime(_time, "%Y-%m-%d %H:15:00"), 
                  m = "30",strftime(_time, "%Y-%m-%d %H:30:00"),
                  m = "45",strftime(_time, "%Y-%m-%d %H:45:00"))
| table system SMF30JBN _time SMF30SRV msused hour m time1