Populate predefined field for found strings

[subtrakt]

Good Day,

I'm attempting to create a label for different search responses.

Example:
if search 'A' finds error "500", Field B. is populated with "test1"
if search 'A' finds error "400", Field B. is populated with "test2"

and soo on.

[martin_mueller]

You could do something like this:

... | eval B = case(search finds error "500", "test1", search finds error "400", "test2)

[subtrakt]

thanks. any idea how to tell it to only display if 400 are greater than 350 count?