Why does the case statement works until an AND is added to it?

[azvargas]

When I have this case statement like this, it "works". It runs and puts values in the iSeries column, but they are wrong.

| eval Platform=case((source="A" OR source="B" OR source="C") , "iSeries", true(),"Other")

When I add an AND to it so that it fulfills the true condition, no values are put in the iSeries column, and everything goes to Other.

| eval Platform=case((source="A" OR source="B" OR source="C") AND (dest=X OR dest=Y OR dest=Z), "iSeries", true(),"Other")

What am I doing wrong?

[isoutamo]

Hi

Is your dest X or "X"?

| makeresults
| eval source="A", dest="X"
| eval Platform=case((source="A" OR source="B" OR source="C") AND (dest="X" OR dest="Y" OR dest="Z"), "iSeries", true(),"Other")

[to4kawa]

In eval statement,

dest=x means the field dest equals the field x.
As @isoutamo says, you need quotes.

[azvargas]

I've tried with and without quotes, and it still doesnt work.

[to4kawa]

>It runs and puts values in the iSeries column.

your working query puts "iSeries" text on Platform field(column).

>it still doesnt work.
what's your expected result?

[azvargas]

Correct, my query puts "iSeries" text in the Platform field.  But it only works without the AND clause, but this is not the right condition.  I need it to work with the AND clause portion.

[isoutamo]

Can you print dest and X etc. if those are fields and not values?

[azvargas]

> Can you print dest and X etc. if those are fields and not values?

Not sure how to do this.  Its a long query.

[isoutamo]

e.g.

| makeresults
| eval foo="A", bar=foo
| eval foobar= "'" . foo . "' '" . bar . "'"
| table foo bar foobar

[azvargas]

I'd like to add that I have had this same criteria for close to a year in a dashboard just not in a case statement and it works.