base-search earliest=-1h@m|
Desk
cli_attr="MOBILE_IND=N"
Mobile
cli_attr="MOBILE_IND=Y"
Emarketing
cli_attr="MOBILE_IND=Y" OR cli_attr="MOBILE_IND=N" PartnerCode=*
Non-Emarketing
cli_attr="MOBILE_IND=Y" OR cli_attr="MOBILE_IND=N" NOT PartnerCode=*
using these am trying to build a base search
|eval deskdev=if(cli_attr=="MOBILE_IND=N","MOBILE_IND=N",NULL)
|eval mobiledev=if(cli_attr!="MOBILE_IND=N","MOBILE_IND=N",NULL)
|eval eMarketing=if((cli_attr=="MOBILE_IND=Y") OR (cli_attr!="MOBILE_IND==Y") AND (PartnerCode=="") , "MOBILE_IND=Y",NULL)
|eval NoneMarketing=if((cli_attr=="MOBILE_IND=Y") OR (cli_attr!="MOBILE_IND=Y") AND (PartnerCode!=""),"MOBILE_IND=Y",NULL)
search not able to match the values with original, how would it possible.
Like this:
base-search earliest=-1h@m
| stats count(eval(searchmatch("cli_attr=\"MOBILE_IND=N\""))) AS deskdev
count(eval(searchmatch("cli_attr=\"MOBILE_IND=Y\""))) AS mobiledev
count(eval(searchmatch("cli_attr=\"MOBILE_IND=Y\" OR cli_attr=\"MOBILE_IND=N\" PartnerCode=\"*\""))) AS eMarketing
count(eval(searchmatch("cli_attr=\"MOBILE_IND=Y\" OR cli_attr=\"MOBILE_IND=N\" NOT PartnerCode=\"*\""))) AS NoneMarketing
It is hilarious but probably won't fly for you to call Non-eMarketing
by None Marketing
, kind of like a psychologist using therpaist.com
.
This should work. I recommend using null()
instead of NULL, but that's not your issue.
Can you provide a sample event? Are you sure your field contents in the events are present and have the exact value you are looking for?
This run-anywhere search validates that your query is correct: | makeresults | eval cli_attr="MOBILE_IND=N" | eval deskdev=if(cli_attr=="MOBILE_IND=N","MOBILE_IND=N",null())
Am good with the Desktop and Mobile , but am not sure how to write the |eval
condition for Emarketing and NonEmarketing. where i struck
This part (cli_attr=="MOBILE_IND=Y") OR (cli_attr!="MOBILE_IND==Y")
makes no sense (it's always true), you may as well leave it out and just use PatnerCode
missing these ?
Emarketing
cli_attr="MOBILE_IND=Y" OR cli_attr="MOBILE_IND=N" PartnerCode=*
Non-Emarketing
cli_attr="MOBILE_IND=Y" OR cli_attr="MOBILE_IND=N" NOT PartnerCode=*
What values can cli_attr have other than MOBILE_IND=Y and MOBILE_IND=N?
Maybe we can help better if you verbally describe the conditions you want to test for and the resulting values for the eval'ed target field, as I am not clear on what you want your outcome to be.
here in the the search we have included a PartnerCode=* and NOT PartnerCode=* there 2 are the differences between emarketing and nonemarketing we should include that part also in the same |eval If condition for each