I have been trying to use the CASE function in splunk, but my results are not correct

[NanSplk01]

This is my search.  I brings back Not Known for every field instead of the correct case name:

index=websphere websphere_logEventType=*
| stats count(websphere_logEventType) BY websphere_logEventType
| eval websphere_logEventType=case(websphere_logEventType=I, "INFO",websphere_logEventType=E, "ERROR", websphere_logEventType=W, "WARNING", websphere_logEventType=D, DEBUG, true(),"Not Known" )

What am I missing that will bring the count and the case that the count is for instead of always the Not Known case?

[ITWhisperer]

Assuming websphere_logEventType is a string, try something like this

| eval websphere_logEventType=case(websphere_logEventType="I", "INFO",websphere_logEventType="E", "ERROR", websphere_logEventType="W", "WARNING", websphere_logEventType="D", "DEBUG", true(),"Not Known" )

Otherwise, I, E, W and D are treated as field names (which don't appear to exist, hence the case evaluates to "Not Known")

[sainag_splunk]

Hey @NanSplk01 try 

... | eval websphere_logEventType=case(websphere_logEventType=I, "INFO", websphere_logEventType=E, "ERROR", websphere_logEventType=W, "WARNING", websphere_logEventType=D, "DEBUG", 1=1, "Not Known")

If this Helps, Please Upvote.

[NanSplk01 · Accepted solution]

Thanks, I used a similar configuration and now it works.  I had to use the == rather than the =

index=websphere websphere_logEventType=*
| stats count(websphere_logEventType) BY websphere_logEventType
| eval websphere_logEventType=case(websphere_logEventType=="I", "INFO",websphere_logEventType=="E", "ERROR", websphere_logEventType=="W", "WARNING", websphere_logEventType=="D", DEBUG, true(),"Not Known" )
| dedup websphere_logEventType