case match command

[parkertctr]

I am trying to use the case match command with more than one option. I keep getting an error message regarding the parenthesis.. nothing is working.. Do not understand whats missing from the syntax.   Here is the search -->

| eval state_ack_error=case(match(_raw, "ACK\-CODE\=AA"), 1, match(_raw matches "STATUS\=SENT"), 1, 1=1, 0)

Error message: Error in 'eval' command: The expression is malformed.

[somesoni2]

Your second match command is not written in correct syntax. Try this:

|  eval state_ack_error=case(match(_raw,"ACK\-CODE\=AA"), 1, match(_raw, "STATUS\=SENT"), 1, 1=1, 0)

[parkertctr]

Thank you.