Hi Team, I am trying to run below query .. now here problem is its not showing any "Blocked" data .. its showing only "Non access Not Blocked " .. is there any syntax error in * OR %? please sugges...
See more...
Hi Team, I am trying to run below query .. now here problem is its not showing any "Blocked" data .. its showing only "Non access Not Blocked " .. is there any syntax error in * OR %? please suggest .. :::|| eval BlockedStatus = case(Like(src,"11.11.111.%") AND act= "REQ_BLOCKED*" ,"Blocked", Like(src,"222.22.222.%") AND act="REQ_BLOCKED*","Blocked", Like(src,"11.11.111.%") AND act!="REQ_BLOCKED*","Not Blocked", Like(src,"222.22.222..%") AND act!="REQ_BLOCKED*","Not Blocked", NOT Like(src,"11.11.111.%") AND act="REQ_BLOCKED*","Non access Blocked", NOT Like(src,"222.22.222..%") AND act="REQ_BLOCKED*","Non access Blocked", NOT Like(src,"11.11.111.%") AND act!="REQ_BLOCKED*","Non access Not Blocked", NOT Like(src,"222.22.222..%") AND act!="REQ_BLOCKED*","Non access Not Blocked") | stats count by Customer , BlockedStatus | rename Customer as "Local Market",count as "Total Critical Events"