I need some assistance with the eval (if) function. I have a CSV file that has been indexed with 100 records. In that CSV, there is a field (fieldX) that has values ranging 1-100. In my output, I only want to return records where fieldX is greater than or equal to 4.
I think the eval with IF function would work here. Maybe something like eval field1=if(fieldX <= 4, "1", "0")
Any suggestions would greatly be appreciated.
thx
Not sure if you actually need to use eval
- if you only want to include the results where fieldX is greater than or equal to 4, couldn't you include it as a regular search filter?
... | search fieldX>=4
Not sure if you actually need to use eval
- if you only want to include the results where fieldX is greater than or equal to 4, couldn't you include it as a regular search filter?
... | search fieldX>=4
yes, that seems to work fine. Thanks!