My requirement is I have to write a search query with eval function which should set the CPU threshold value dynamically Ex: cpu usage >50 it should return value with "CPU usage is normal". cpu usage <50 & >75 it should return value "CPU usage is warning". cpu usage <75 it should return value "CPU usage is warning". I have tried with case(...). but I want below query in any custom function index="my_index" source="data.csv" | eval Threshold=case(cpuusage<=50, "CPU usage is normal", cpuusage>50 AND cpuusage<=75, "CPU usage is warning ", cpuusage>75,"Critical") | table cpuusage Threshold by traceid please do help me on this ... View more