I have a query which displays some tabular results and when a certain condition is matched for 2 field values I want to insert a new value to Field_A like below
If fieldA="not registered" and fieldB="PROVISIONING" for a list of hosts then I want to change the Field_A value from "not registered" to "registered but not monitored"
How can I write an eval condition to satisfy the above. I have some how managed to get a little further like below
| eval fieldA=if(fieldA=="not registered" AND field_B=="PROVISIONING")
Please complete the above part eval condition above if someone knows how to do it?
How about this?
| eval field_A=if(field_A=="not registered" AND field_B=="PROVISIONING", "regiestred but not monitored", field_A)
View solution in original post
hello , Please how can i create a condition in a search to replace an event with a name , even if this event does not exist at the moment