ex: if value1=1 and value2=2
then i should be able to eval value3 based on a comparison condition ( i.e value3>90,test,value3 )
is this possible or is there any workaround to achieve this ?
John.
The question may be confusing. Could you post some sudo code to describe what you're trying to achieve? Are you looking to do something like this?
...| eval value3=if(value1=1 AND value2=2,if(value3>90,test,value3),"SomeOtherDefaultValue")
Hi jiaqya,
try this:
... | eval new_value=case(value1="1" AND value2="2", value3, 1=1, "unknown")
or this:
... | eval new_value=if(value1="1" AND value2="2", value3, somethingelse)
Hope this helps ...
cheers, MuS
Hi, i realised i could do value1-value2 directly and get the difference and then i was able to set the value based on the difference..
value1 and value 2 were columns..
thanks for your responses, i could get to where i wanted to be..