Why is eval case not evaluating fields?

[lemospt]

Hi,

i have a field with the models, like below, and with this info i want to define a new field like brand.

lemospt_0-1689847454131.png

i tried different approaches but can't get brand field populated, below a test search with different case, none works but where clause works well.

index=core_ct_report_*
| where (report_model = "cfgHT802")
| eval brand=case(report_model=cfgHT802, grandstream)
| eval brand2=case(like(report_model, cfgHT802), grandstream)
| eval brand3=case(like(report_model, "cfg%"), grandstream)
| table report_model brand brand2 brand3

lemospt_1-1689847761965.png

what is wrong?

What i need is something like this,

| eval brand3=case(like(report_model, "cfg%"), grandstream, ...)

Thanks,

[lemospt]

Thanks both for the inputs @ITWhisperer @yuanliu 

the problem is the missing double quotes on the true condition like @ITWhisperer said.

[ITWhisperer · Accepted solution]

What is grandstream? If it is a field with content, then at least brand3 should have worked. If it is supposed to be a string, then it needs to be quoted (as do the other strings

| eval brand=case(report_model="cfgHT802", "grandstream")
| eval brand2=case(like(report_model, "cfgHT802"), "grandstream")
| eval brand3=case(like(report_model, "cfg%"), "grandstream")

[yuanliu]

First, note that screenshots are very unfavorable for volunteers.  Please use text for illustration wherever possible.

Secondly, SPL interprets bare strings on the right-hand side (evaluation expressions) as field names.  To match strings, you need to quote them properly.

index=core_ct_report_*
| where (report_model = "cfgHT802")
| eval brand=case(report_model=="cfgHT802", grandstream)
| eval brand2=case(like(report_model, "cfgHT802"), grandstream)
| eval brand3=case(like(report_model, "cfg%"), grandstream)
| table report_model brand brand2 brand3