My eval statement below is to check if 'Action is Required' only if the below conditions are met, I have also used case and if statement to determine this, however none of these have worked.
Contains the word "Hosting" in the Path field
| eval VaronisStatus=if(('(g)Location'!="Varonis" AND(MonitoringStatus!="Monitored") AND like(Path,"%Hosting%")),"Action Required", "No Action Required")
|| eval VaronisStatus=case(('(g)Location'!="Varonis" AND(MonitoringStatus!="Monitored") AND like(Path,"%Hosting%")),"Action Required" , 1=1,"No Action Required")
Both of your approaches work on my system with test events. I don't see any functional difference between your first approach and the one suggested by @mayurr98 below, but if it works for you, great. If it doesn't, can you share some sample events that are being incorrectly categorized?
when i run this:
|makeresults|eval "(g)Location"="Varonis" |eval MonitoringStatus="notMonitored"|eval Path="Hosting"| eval VaronisStatus=if(('(g)Location'!="Varonis" AND (MonitoringStatus!="Monitored") AND like(Path,"%Hosting%")),"Action Required", "No Action Required")
i get "No Action Required" and when i change the (g)Location
to notVaronis, I get Action Required
what exactly isn't working with this?
try this run anywhere search
|makeresults|eval "(g)Location"="Varonis" |eval MonitoringStatus="NotMonitored"|eval Path="Hosting"| eval VaronisStatus=if('(g)Location'!="Varonis" AND MonitoringStatus!="Monitored" AND like(Path,"%Hosting%"),"Action Required", "No Action Required")
you should try
| eval VaronisStatus=if('(g)Location'!="Varonis" AND MonitoringStatus!="Monitored" AND like(Path,"%Hosting%"),"Action Required", "No Action Required")
let me know if this helps !