If / Then Conditional.

[codichulo]

Heres what i'm trying to accomplish: 

requestID               status
123456                   errored
321654                  Success
789456                 errored

I'm Newbie, Maybe i'm going about this all wrong, and there maybe another way....but i don't think so based on what info i have. but heres what i got so far. I'm probably over-thinking this. 

index=someindex sourcetype=sometype "request syntax" OR "error syntax" OR "success syntax"
| rex field=_raw "request id: '(?<requestID>\d+)',\text"
| rex field=_raw ".*(?<error>Error response received)\stext"
| rex field=_raw ".*(?<Success>Database request executed):\stext"
| eval requestID =if(requestID=(error),"Errored", "Success")

[bowesmana]

There are a couple of oddities/errors in your query, e.g. there is no 's' after the \ in the request ID rex statement and the if statement would not need the () round error, however, it depends on your data as to what your query should look like - can you provide a sample?

However,  from your example query, this might be better (I have removed the trailing data outside the field capture group

index=someindex sourcetype=sometype "request syntax" OR "error syntax" OR "success syntax"
| rex field=_raw "request id: '(?<requestID>\d+)'"
| rex field=_raw ".*(?<error>Error response received)"
| rex field=_raw ".*(?<Success>Database request executed)"
| eval status=if(requestID=error,"Errored", "Success")

this is assuming that the rex statement extracting the field 'error' will give the same value as the requestID field. What is your intention with Success field extraction 

[codichulo]

oh sorry, the rex statements are working fine, i just removed identifiable info to make them look generic, and in doing so made them look in error. 

it was the eval statement that i couldn't get to work right. I'll try your suggestion. Thanks so much. 

[to4kawa]

what's the logs.
your regex is not good.