Hi all,
I got some problems categorizing a custom field according to its content; to do so I am using multiple eval IF commands:
| eval Myfield=if(Like(Myfield, "%Windows%"), "Microsoft", Myfield)
| eval Myfield=if(Like(Myfield, "%iPhone%"), "Apple", Myfield)
| eval Myfield=if(Like(Myfield, "%Android%"), "Google", Myfield)
With a simple stats count by MyField i got both the number of Microsoft, Apple and Google values and the explicit values for everything else. So far is exactly what I need.
Now I want to expand this query in two ways
1- Including multiple conditions for the same value (to save writing a sigle eval for each case)
| eval Myfield=if(Like(Myfield, "%Windows%" OR "%Office%" OR "%Notepad%"), "Microsoft", Myfield)
2 - Including an "Other" value for everything that is not specified
| eval Myfield=if(NOT Like(Myfield, "%Windows%" OR "%iPhone%" OR "%Android%"), "Other", Myfield)
However neither of two is working: I got some SPL grammar or logic problem that still can't solve...
... View more