@Mohsin123
Can you please try this?
YOUR_SEARCH
| eval A=case(Response_time<1000,"lt1Sec",Response_time>=1000 AND Response_time<=3000,"bet1-3Sec",Response_time=3000,"gt3SEC")
Sample Search
|makeresults
| eval Response_time=3000
| eval A=case(Response_time<1000,"lt1Sec",Response_time>=1000 AND Response_time<=3000,"bet1-3Sec",Response_time=3000,"gt3SEC")
Hi,
this is working :
|makeresults
| eval Response_time=3000
| eval A=case(Response_time<1000,"lt1Sec",Response_time>=1000 AND Response_time<=3000,"bet1-3Sec",Response_time=3000,"gt3SEC")
in an independent search but not working with my search ....
........
| eval Response_time=case(Response_time<1000,"lt1Sec",Response_time>=1000 AND Response_time<=3000,"bet1-3Sec",Response_time=3000,"gt3SEC")
@Mohsin123
Can you please replace your value in my sample search and execute?
|makeresults
| eval Response_time=<<REPLACE_YOU_VALUE>>
| eval Response_time=case(Response_time<1000,"lt1Sec",Response_time>=1000 AND Response_time<=3000,"bet1-3Sec",Response_time=3000,"gt3SEC")
OR
Can you please share the sample output of your search? So I can work on it.
YOUR_SEARCH | table Response_time | head 5
Hi There,
I'm assuming that you have already created the field "Response_time" prior to the case statement? What isse are you running into with the search?
Hi There,
You may want to try a case statement for this, unless there are any other variables you need to create:
|eval FIELDNAME=case(Response_time>3000, Response_time="gt3SEC", Response_time>1000 AND Response_time<3000, Response_time="bet1-3Sec", Response_time<1000, Response_time="lt1Sec")
i am getting this error
Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr]).
Apologies, try this:
|eval Response_time=
case(Response_time>3000, "gt3SEC", Response_time>1000 AND Response_time<3000, "bet1-3Sec", Response_time<1000, "lt1Sec")