Hi,
I have below scenario. My brain is very slow at this time of the day!
I need an eval to create Status field as in the table below that will flag a host if it is running on IPv4 OR IPv6 OR both IPv4 +IPv6.
HOSTNAME | IPv4 | IPv6 | Status |
SampleA | 0.0.0.1 | IPv4 | |
SampleB | 0.0.0.2 | IPv6 | |
SampleC | 0.0.0.3 | A:B:C:D:E:F | IPv4 + IPv6 |
Thanks in-advance!!!
There may be a few ways to do that. Here's one.
| eval Status = case(isnotnull(IPv4) AND isnotnull(IPv6), "IPv4 + IPv6",
isnotnull(IPv4), "IPv4",
isnotnull(IPv6), "IPv6",
1==1, "")
Thanks @richgalloway!!
There may be a few ways to do that. Here's one.
| eval Status = case(isnotnull(IPv4) AND isnotnull(IPv6), "IPv4 + IPv6",
isnotnull(IPv4), "IPv4",
isnotnull(IPv6), "IPv6",
1==1, "")