Multiple eval of the same field

[jlelli]

Hi all,
I got some problems categorizing a custom field according to its content; to do so I am using multiple eval IF commands:

| eval Myfield=if(Like(Myfield, "%Windows%"), "Microsoft", Myfield) 
| eval Myfield=if(Like(Myfield, "%iPhone%"), "Apple", Myfield) 
| eval Myfield=if(Like(Myfield, "%Android%"), "Google", Myfield)

With a simple stats count by MyField i got both the number of Microsoft, Apple and Google values and the explicit values for everything else. So far is exactly what I need.

Now I want to expand this query in two ways
1- Including multiple conditions for the same value (to save writing a sigle eval for each case)

| eval Myfield=if(Like(Myfield, "%Windows%" OR "%Office%" OR "%Notepad%"), "Microsoft", Myfield)

2 - Including an "Other" value for everything that is not specified

| eval Myfield=if(NOT Like(Myfield, "%Windows%" OR "%iPhone%" OR "%Android%"), "Other", Myfield)

However neither of two is working: I got some SPL grammar or logic problem that still can't solve...

[somesoni2 · Accepted solution]

This is the classing use case for case command. Try something like this. Also, see how the like expression for multiple matches is done here (which causing SPL issues for you before).

your base search
| eval Myfield=case(like(Myfield, "%Windows%") OR like(Myfield, "%Office%") OR like(Myfield, "%Notepad%"), "Microsoft", like(Myfield, "%iPhone%"), "Apple", like(Myfield, "%Android%"), "Google", true(),"Other")
| stats count by Myfield

[jlelli]

Thank You,
I still misspell some comma here and there but your logic is way simpler and faster to use.