All,
I have the search below which is using eval and IF statement. I only want one of the search conditions to execute every time this search is called using the $LOB$ variable. It appears the logic is correct and seems like other ppl have gotten this type of search to work, but the below does not work.
To simplify my question, here is the logic
| eval IF "(condition)",then, "Search1", else, "Search2"
Any help on why this may not work??
| eval (newLOB1=if(($LOB$ != "*"),
"([search index=aws-ec2inventory | fields - _raw | table accountName, instanceId,PrivateIPAddress | dedup instanceId | eval (newLOB=(replace("$LOB$","COF-","")) |where accountName=newLOB | stats count])"),
"([search index=aws-ec2inventory | fields - _raw | table accountName, instanceId,PrivateIPAddress | dedup instanceId | search accountName=* | stats count])"))
... View more