Why does this eval case not work?

[jaycetan]

The following is my ideal final query to be used in a dashboard.

index=cdn_app httpMessage.host=taxes* 
| eval _env=$env_host$ 
| eval _hostName=case(_env=="http:abc-h123-apps-prod","taxes.sf.com", _env=="http:abc-h123-apps-qa", "taxes-qa.sf.com") 
| search httpMessage.host=_hostName 
| spath output=status path=httpMessage.status
| eval status=case(like(status, "2%"),"2xx",like(status, "4%"),"4xx",like(status, "5%"),"5xx") | stats count by status 

It seems `_hostName` is not resolving even when I hardcode and values like so.

index=cdn_app httpMessage.host=taxes* 
| eval _env="taxes.sf.com"
| eval _hostName=case(_env=="http:abc-h123-apps-prod","taxes.sf.com", _env=="http:abc-h123-apps-qa", "taxes-qa.sf.com") 
| search httpMessage.host=_hostName 
| stats count by httpMessage.host 

I'm sure its with my eval case because this works just fine.

index=cdn_app httpMessage.host=taxes* 
| search httpMessage.host="taxes.sf.com"
| stats count by httpMessage.host 

Open to any suggestions. Thanks!

[ITWhisperer]

Try with a where command

index=cdn_app httpMessage.host=taxes* 
| eval _env=$env_host$ 
| eval _hostName=case(_env=="http:abc-h123-apps-prod","taxes.sf.com", _env=="http:abc-h123-apps-qa", "taxes-qa.sf.com") 
| where httpMessage.host=_hostName 
| spath output=status path=httpMessage.status
| eval status=case(like(status, "2%"),"2xx",like(status, "4%"),"4xx",like(status, "5%"),"5xx") | stats count by status

[richgalloway]

Avoid field names beginning with an underscore.  They (with a few exceptions) are hidden by Splunk.  Even most of the built-in underscored fields have to be copied to a regular field name before anything can be done with them - _index_time is a common example.

[jaycetan]

I initially had the values without the underscores. Unfortunately, removing them does not fix the issue. Appreciate the advice.

[richgalloway]

The case function is missing a default case so anything that doesn't match one of the two strings will be null.  Null hosts will be ignored by the stats command.

index=cdn_app httpMessage.host=taxes* 
| eval env="taxes.sf.com"
| eval hostName=case(env=="http:abc-h123-apps-prod","taxes.sf.com", 
                     env=="http:abc-h123-apps-qa", "taxes-qa.sf.com", 
                     1==1, "???") 
| search httpMessage.host = hostName 
| stats count by httpMessage.host