I am looking for a way to check for multiple conditions to match, and if they are met, output a specific word... such as "true". Example: my_cool_search_here | eval condition_met=if(user=* AND Do...
See more...
I am looking for a way to check for multiple conditions to match, and if they are met, output a specific word... such as "true". Example: my_cool_search_here | eval condition_met=if(user=* AND DoW IN (Mon,Wed) AND HoD IN (01,02,03) AND hostname IN ("hostname.hostdomain","hostname.hostdomain"), "true") I don't know if that makes sense... but essentially I want to check whether "user" has ANY value, and then if the fields "DoW", "HoD", and "hostname" have specific values out of a possible range.... and if all that matches, then set the value of "condition_met" to "true". I know I can do this for a single field/value, but how would I accomplish this for multiple different conditions? Thanks!