Why does multiple eval statements cause only last to be run?

[markhvesta]

I am trying to create a low volume type of alert based on one sourcetype for multiple Channels that have very different amounts of traffic. The search I am using is as follows:

sourcetype="mytraffic"
| chart count as Count by Channel
| eval MeetThreshold?=if((Count<=4) AND (Channel=="Web"),"Fail","Pass")
| eval MeetThreshold?=if((Count<=400) AND (Channel=="Mobile"),"Fail","Pass")
| table Channel Count MeetThreshold?

In my tests, it seems the results only reflect the status of the last eval statement. Is there a better way to do this?

[woodcock · Accepted solution]

You need to use case like this:

sourcetype="mytraffic"
| chart count as Count by Channel
| eval MeetThreshold=case(
   (Count<=4) AND (Channel=="Web"), "Fail",
   (Count<=400) AND (Channel=="Mobile"), "Fail",
   true(), "Pass")
| table Channel Count MeetThreshold

[markhvesta]

That is perfect. Thank you

[jkat54]

Thats because your defining the same field name. try this approach instead:

 sourcetype="mytraffic"
 | chart count as Count by Channel
 | eval MeetThreshold1=if((Count<=4) AND (Channel=="Web"),"Fail","Pass")
 | eval MeetThreshold2=if((Count<=400) AND (Channel=="Mobile"),"Fail","Pass")
 | eval MeetThreshold=coalesc(MeetThreshold1,MeetThreshold2)
 | table Channel Count MeetThreshold

[jkat54]

Or you can make one long case / if:

  sourcetype="mytraffic"
  | chart count as Count by Channel
  | eval MeetThreshold=if((Count<=4 AND Channel=="Web"),"Fail",if((Count<=400 AND Channel=="Mobile"),"Fail","Pass")))
  | table Channel Count MeetThreshold

  sourcetype="mytraffic"
  | chart count as Count by Channel
  | eval MeetThreshold=case(
   Count<=4 AND Channel=="Web","Fail",
   Count<=400 AND Channel=="Mobile","Fail",
   1=1,"Pass")
  | table Channel Count MeetThreshold