Multiple/Nested IF statement

[davidcraven02]

My logic for my field "Action" is below, but because there is different else conditions I cannot write an eval do achieve the below.

if (Location="Varonis" AND **** (like(Path,"%Hosting%")
then Status=Action Required

else if(Location="Varonis" AND **** ( MonitoringStatus!="Monitored" OR MonitoringStatus=null )
then Status=Action Required

else if(Location="Varonis" AND **** ( DayBackUpStatus!="Backed Up" OR DayBackUpStatus=null )
then Status=Action Required

else if(Location="Varonis" AND **** ( DayBackUpStatus!="Backed Up" OR DayBackUpStatus=null )
then Status=Action Required

[micahkemp]

Duplicate of https://answers.splunk.com/answers/608778/eval-for-else-if-condition.html

[mayurr98]

hey try this

 ...|eval Status=case((Location="Varonis" AND (like(Path,"%Hosting%"))),"Action Required",(Location="Varonis" AND ( MonitoringStatus!="Monitored" OR MonitoringStatus="null" )),"Action required",(Location="Varonis" AND ( DayBackUpStatus!="Backed Up" OR DayBackUpStatus="null" )),"Action Required",1<2,"No Action required")

OR

  ...|eval Status=if((Location="Varonis" AND (like(Path,"%Hosting%"))),"Action Required",(Location="Varonis" AND ( MonitoringStatus!="Monitored" OR MonitoringStatus="null" )),"Action required",(Location="Varonis" AND ( DayBackUpStatus!="Backed Up" OR DayBackUpStatus="null" )),"Action Required","No Action required")

Let me know if this work!