Using If then in combination with case

[kennyja]

I would like to create a new tag field based on multiple conditions. I think I have figured out how to specify my conditions, but I would like to create a true/false result in a new field. I am not sure how to do this.

Here is my command so far. I would like to create a new true/false field based on whether or not "hostgroup" is a match with all of the conditions specified. Should return true is case is a match, and false if not.

sourcetype= | eval hostgroup=case(host LIKE "%BE%", "BE", host LIKE "%MT%", "MT", host LIKE "%FE%", "FE", host LIKE "%", "Others")

Any tips on how to setup the true/false portion of my request?

Thanks

[Runals]

Not sure if this is what you are thinking of but I'd add , 1=1, "Other") at the end of my case statement. That way something evaluates to true. Actually what I normally use for the string is 'fixme' 😃

[sundareshr]

You can append this to your search (assuming your case statement is returning as expected)

.... | eval found=if(hostgroup="Others", false, true)

[ryanoconnor]

Just to clarify, the "Others" value here is not indicative of all of the previous matches conditions being met but it's the opposite. "Others" in this case means that the hostgroup string did not contain BE, MT, or FE.

If you append what @sundareshr is suggesting, the string 'found' would be false if the hostgroup string did not contain BE, MT, or FE and would be true if the hostgroup string contained any one of those things.

I'm not sure if Others is supposed to represent that or not, but if it is this should take care of your issue.

[ryanoconnor]

is hostgroup a field in your data? Can you let us know specifically what a true and a false condition would look like?