I am trying to use the case match command with more than one option. I keep getting an error message regarding the parenthesis.. nothing is working.. Do not understand whats missing from the syntax. Here is the search -->
| eval state_ack_error=case(match(_raw, "ACK\-CODE\=AA"), 1, match(_raw matches "STATUS\=SENT"), 1, 1=1, 0)
Error message: Error in 'eval' command: The expression is malformed.
Your second match command is not written in correct syntax. Try this:
| eval state_ack_error=case(match(_raw,"ACK\-CODE\=AA"), 1, match(_raw, "STATUS\=SENT"), 1, 1=1, 0)
Thank you.