How to solve this issue with eval if?

[SumanPalisetty]

Hi,

I am facing an issue with the eval if condition. Please help.

index=main, source=ls.csv
| eval new_field = if(error=200,"sc","cs",if(error=500,"css","ssc"))
| table error new_field

erro.png

Regards

Suman P.

[richgalloway · Accepted solution]

There are too many arguments to the first if.  Each if function can have only 3 arguments - an expression to test, the value to set if true, and the value to set if false.  If you want nested ifs then it needs to look more like this:

| eval new_field = if(error=200,"sc", if(error=500,"css","ssc"))