Hi @VijaySrrie , they should work also using three different calculated fields, anyway, you could nest the conditions from the other calculated fields, even if the final caculated fied will be longe...
See more...
Hi @VijaySrrie , they should work also using three different calculated fields, anyway, you could nest the conditions from the other calculated fields, even if the final caculated fied will be longer: | eval action=
case(error="invalid credentials", "failure", ((like('request.path',"auth/ldap/login/%") OR like('request.path',"auth/ldapco/login/%")) AND (NOT error="invalid credentials")) OR (like('request.path',"auth/token/lookup-self") AND ('auth.display_name'="root")) ,"success")
| eval app=case(action="success" OR action="failure", "appname_Authentication")
| eval valid=if(error="invalid credentials","Error","Success") Ciao. Giuseppe