About ibdubs

ibdubs · ‎03-28-2019

noted in a comment below index=foo EventCode=bar | eval Account_Type=case(like(Account_Name,"R%"),"AccountType1",like(Account_Name,"D%"),"AccountType2",like(Account_Name,"X%"),"AccountType3",1==1,"unknown") | stats count by Account_Type

ibdubs · ‎03-28-2019

This did require a "," after the first accounttype1 and a parenthesis at the end (for any future users) but this works perfectly thank you! Its been driving me nuts

ibdubs · ‎03-28-2019

I get the below error with this version of the search Error in 'eval' command: The 'count' function is unsupported or undefined

ibdubs · ‎03-28-2019

When I do this it labels them all as "unknown" but does contain the correct count next to it.

ibdubs · ‎03-28-2019

So I'm sure I'm missing something obvious, but I cannot for the life of me find something similar to what I'm looking for. I'm trying to take a search that returns all Accounts that have changed their password, and separate them into the 3 different types of accounts I have with a count. The different accounts start with different letters, which can be searched with Account_Name=R* to get the R account type. Index=foo EventCode=bar | act1=count(if Account_Name=R*), act2=count(if Account_Name=D*)...etc |table act1 act2 act3 I tried my best to find this, but I simply cannot figure out where to start with that conditional. Thank you in advance

Posts	5
Solutions	0
Karma Given	2
Karma Received	2
Member Since	‎03-28-2019

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How do you separate fields into different variable...

Re: How do you separate fields into different vari...

Re: How do you separate fields into different vari...

Re: How do you separate fields into different vari...

Re: How do you separate fields into different vari...

How do you separate fields into different variable...