My field has following value
summary="java running in chrome"
I need a search such that summary should have the word "java" and shouldn't have "chrome", "firefox".
My search is :
|eval Application = case(Summary like "%Java%" NOT "%chrome%" NOT "%firefox%","Java",Summary like "%flash%","flash")
but it is not working. Can anyone guide me?
NOT keyword in not supported for case statement, so use ! instead for performing not expression.
|eval Application = case(Summary like "%Java%" AND ! ( Summary like "%chrome%" OR Summary like "%firefox%"),"Java",Summary like "%flash%","flash")
Try something like this
your current search
|eval Application = case(match(Summary,"Java") AND NOT (match(Summary,"chrome") OR match(Summary,"firefox")), "Java" ,match(Summary,"flash"),"flash", true(),"other")
NOT keyword in not supported for case statement, so use ! instead for performing not expression.
|eval Application = case(Summary like "%Java%" AND ! ( Summary like "%chrome%" OR Summary like "%firefox%"),"Java",Summary like "%flash%","flash")
not working 😞
getting the following error.
Typechecking failed. 'OR' only takes boolean arguments.
I have edited my answer as I was missing Summary like conditions in the not condition. Can you please retry the above and confirm?