Searchmatch with AND does not work

[christi2019]

Notifications and ChangeNotifications present in both indices and I want to separate them by index type and count them. Looks like searchmatch with AND function seems not working.Is there better way to have these fields seperated by index type.

index=service1 OR index=service2
*/application/Notification OR
*/application/changeNotification
| eval timeevents=case(searchmatch("Notifcations" AND "index=service1" ),"Service1NewNotification",
searchmatch("Notifcations" AND "index=service2" ),"service2NewNotification",
searchmatch("changeNotifications"AND "index=service1"), "service1newChangeNotifications",
searchmatch("changeNotifications"AND "index=service2"), "service2newChangeNotifications",

| stats count by index, timeevents

[christi2019]

thanks Niketnilay.

[niketn · Accepted solution]

@christi2019 try the following

1) Since index is already a field you do not need to do searchmatch which looks at entire raw data for pattern match.
2) Since your stats is already splitting data by index and timeevents, there is no need to merge index while evaluating timeevents.

| eval timeevents=case(searchmatch("Notifcations"),"NewNotification",
                       searchmatch("Notifcations"),"NewNotification",
                       searchmatch("changeNotifications"), "newChangeNotifications",
                       searchmatch("changeNotifications"), "newChangeNotifications")
| stats count by index, timeevents

However, if you want to perform multiple matches inside a case expression you can try one of the following approaches. All should give same output but with different performance.
Option 2

| eval timeevents=case(searchmatch("Notifcations") AND index="service1","Service1NewNotification",
                       searchmatch("Notifcations") AND index="service2","service2NewNotification",
                       searchmatch("changeNotifications") AND index="service1", "service1newChangeNotifications",
                       searchmatch("changeNotifications") AND index="service2", "service2newChangeNotifications")

Option 3: Following may not work unless your raw data actually has text like "index=service"

| eval timeevents=case(searchmatch("Notifcations") AND searchmatch("index=service1" ),"Service1NewNotification",
                       searchmatch("Notifcations") AND searchmatch("index=service2"),"service2NewNotification",
                       searchmatch("changeNotifications") AND searchmatch("index=service1"), "service1newChangeNotifications",
                       searchmatch("changeNotifications") AND searchmatch("index=service2"), "service2newChangeNotifications")