Gents.
Thank you very much.
Proper placement of camas and double quotes solved the issue
------------
If your problem is resolved, then please click the "Accept as Solution" button to help future readers.
Thank you for recommendations.
Gut an error:
Error in 'EvalCommand': The expression is malformed. Expected ).
Am I need double (()) around entire statement?
You do not need double parentheses. Verify the parentheses and quotation marks match. Share your exact query if you need an extra set of eyes to look at it.
Have you tried putting quotes around the group names?
| eval GR=case(host=5087, "GR2", host=7750, "GR1", host=7751, "GR1", host=7752, "GR2")
| stats count by GR
Hi @bigll,
use quotes in eval:
| eval GR=case(host="5087", "GR2", host="7750", "GR1", host="7751", "GR1", host="7752", "GR2")
| stats count by GR.
Ciao.
Giuseppe