is it possible to have expression in case command for argument Y?
case(x,y)
|eval test=case(x=="X", 'a+b')
The Y argument, instead of a strings or number, can it be an expression like field a + field b?
Thanks
The Y argument can be anything valid for an eval statement. IOW, if
| eval test=Y
works then
| eval test=case(X, Y)
should also work.
Thank you for reply. I did a simple test on simple text event data and |eval test=case(x=="X", a+b) does work.
If your problem is resolved, then please click the "Accept as Solution" button to help future readers.
