I am trying to eval a new field based on matching several sub searches. The issue is that these sub searches can potentially return an empty result which breaks the syntax of the eval command. Example: index=A loglevel=error | eval group=case( [search "search string 1" | fields correlationField], "group 1", [search "search string 2" | fields correlationField], "group 2" 1=1, "other") In this example if "search string 1" is not found in the time range then an empty result is used for the condition for group 1, which causes an error: Error in 'eval' command: The expression is malformed. An unexpected character is reached at ') ... View more