How to use "CASE" statements to get the results based on multiple conditions and multiple fields?

[rajhemant26]

Hello everyone.

Want to display the output only for the time which crosses 18 months (earliest time)

[nickhills]

Typed on a phone, so there may be errors, but would something like this work for you?

 ...|search QUEUE=message*
    |eval level=case((QUEUE=MESSAGE1 AND QueueDepth>=400 AND MessageAge>=400), "high", (QUEUE=MESSAGE2 AND QueueDepth>=200 AND MessageAge>=300), "high", (QUEUE=MESSAGE3 AND QueueDepth>=100 AND MessageAge>=300), "high",1=1,"other")
    |where level="high"
    |stats count by QUEUE