How to group multiple field values into one field

[DEAD_BEEF]

I have logs where I want to count multiple values for a single field as "start" and other various values as "end". How would I go about this? I want to be able to show two rows or columns where I show the total number of start and end values.

index=foo (my_field=1 OR my_field=2 OR my_field=3 OR my_field=4 OR my_field=5 OR my_field=6)
| eval start = my_field=1 OR my_field=2 OR my_field=3
| eval end = my_field=4 OR my_field=5 OR my_field=6
| stats count by start end

[DEAD_BEEF · Accepted solution]

I ended up using case

index=foo (my_field=1 OR my_field=2 OR my_field=3 OR my_field=4 OR my_field=5 OR my_field=6)
| eval status=case(my_field=1 "start", my_field=2 "start", my_field=3 "start", my_field=4 "end", my_field=5 "end", my_field=6 "end")
| stats count by status

[somesoni2]

That would be the way to go. A minor cosmetic change (clubbing multiple conditions together, adding else/default forrest of values/conditions):

index=foo (my_field=1 OR my_field=2 OR my_field=3 OR my_field=4 OR my_field=5 OR my_field=6)
 | eval status=case(my_field=1 OR my_field=2 OR  my_field=3, "start", true(), "end")
 | stats count by status

[khreddy]

You could use "in" function to check the static value list to the above query:

index=foo (my_field=1 OR my_field=2 OR my_field=3 OR my_field=4 OR my_field=5 OR my_field=6)
| eval status=case(in(my_field,1,2,3),"Start",in(my_field,4,5,6),"End",1==1,NULL)
| stats count by status