Hi @nicolass, you can use the OR option in the if confition of your eval command, something like this: source="test.csv" sourcetype="csv"
| stats values("MFA Factor") as MFA, values("Last Enrolled_ISO8601") as "Last Enrolled", values( "Last Used_ISO8601") as "Last Used" by User, Login
| eval MFA=if(like(MFA,"Okta%") OR like(MFA,"%FIDO%") OR like(MFA,"Google%") OR like(MFA,"Voice%"),null, MFA)
| where isnotnull(MFA) or use case instead if: source="test.csv" sourcetype="csv"
| stats values("MFA Factor") as MFA, values("Last Enrolled_ISO8601") as "Last Enrolled", values( "Last Used_ISO8601") as "Last Used" by User, Login
| eval MFA= case(like(MFA,"Okta%"),null, like(MFA,"%FIDO%"),null, like(MFA,"Google%"),null, like(MFA,"Voice%"),null)
| where isnotnull(MFA) Ciao. Giuseppe
... View more