Hi Iam looking to create an if statement: if value contains part of another value it changes it too another value.
for example contains x its true if not its false.
| eval error=if(in(status, "error", "failure", "severe"),"true","false")
I also want it for many values.
Using the match() function should do what you need.
| eval error=if(match(status, "(?i)error") OR match(status, "(?i)failure") OR match(status, "(?i)severe"),"true","false")
If however you have a bunch of matching patterns, having all of them in a lookup file and using wildcard matching might be a better option.
Using the match() function should do what you need.
| eval error=if(match(status, "(?i)error") OR match(status, "(?i)failure") OR match(status, "(?i)severe"),"true","false")
If however you have a bunch of matching patterns, having all of them in a lookup file and using wildcard matching might be a better option.
Thanks for the solution. But If theres value say it has server 1 failed. How do I one look for if value has failed in its string then it does somthing.
You can use match(status, "(?i)fail") and it'll match failed, fail, failure, failing.