Is there a better way to write EVAL to modify information in a chart

[kshanky143]

Hi

I have the query which yields the results i want, but i would like to know if there's a cleaner way to achieve my goal.

I have the following table
Source ------------------------- Item3Count
Item1 ----------------------------- 1
Item2 ----------------------------- 1
Item3 ----------------------------- 22
Item4 ----------------------------- 1

I would like to modify the above table to look like this (should show count value for item3 only)
Source ------------------------- Item3Count
Item1 ----------------------------- 0
Item2 ----------------------------- 0
Item3 ----------------------------- 22
Item4 ----------------------------- 0

Currently my query looks like this ... It works but i feel like its too many lines of query to make small modification. Please let me know if there's a better way to write the same query

| chart values(Item3Count) by Source
| eval Item3Count=if(match(source,"item1"),0,Item3Count)
| eval Item3Count=if(match(source,"item2"),0,Item3Count)
| eval Item3Count=if(match(source,"item4"),0,Item3Count)

Thanks
Sheshank

[chimell]

Hi kshanky143
You can also use this :

    ....|replace 1 with 0 in Item3Count

[kshanky143]

Item1, Item2, Item3 can have any value.

[ngatchasandra]

Hi kashanky143,

Look this:

| chart values(Item3Count) by Source 
| eval Item3Count=if(match(source,"item1") OR match(source,"item2") OR match(source,"item4"),0,Item3Count) 

[sideview · Accepted solution]

You really only need one of these for the "item3" row. The way you're doing it is harder cause you have to match all the other rows. Better to do the reverse and match only the one you want. The rest will get zeros when source does not match "item 3".

| eval Item3Count=if(match(source,"item3"),0,Item3Count) 

[kshanky143]

Do you mean this .. ? I think u missed '!'
| eval Item3Count=if(!match(source,"item3"),0,Item3Count)

[sideview]

Oh right. You want the other way around. Sorry.

| eval Item3Count=if(match(source,"item3"),Item3Count,0)