How to use map to calculate fields data separately for each entity?

[amitrinx]

Hi,

I have a combination of consumer limits

e.g, A=1000 b=500 c=500 d=200 rest=100
So basically i want a list of all consumer who reached 80% limit. So i wrote a query for one consumer. how can i accommodate all other consumers with different limits. Should i write separate query for each consumer?

sourcetype="OS"
operation= "ABC"
consumer_src="A"
| search minutesago= 1
| stats count by consumer_src
| where count >= 0.8 * 1000

[ITWhisperer · Accepted solution]

sourcetype="OS"
operation= "ABC"
| search minutesago= 1
| stats count by consumer_src
| eval limit=case(consumer_src=="A", 1000, consumer_src=="b", 500, consumer_src=="c", 500, consumer_src=="d", 200, 1==1, 100)
| where count >= 0.8 * limit