Something about this search makes it so we absolutely never get into the case that would label the column "msad". I have tried switching everything up: Making the zscaler case first, changing the msad case so that it just needs to meet the condition =* and every other tweak of syntax and values.
As an FYI, I have tried searching the default search separately and get events that meet both of the criteria mentioned in the case statement.
(index=zscaler) OR (index=msad) query=*debug*opendns*
| eval field=case(index="msad" AND query="*debug*","msad",index="zscaler" AND query="debug.opendns.com","Zscaler", true(),"undefined")
| timechart span=1h count by field
In this situation, it defaults to the undefined, which technically is all the events that I want labeled as msad and could change that to get desired results, but I'm posting this question because I am trying to understand the functionality of this command more then finding a workaround.
To me, it's very frustrating that the case statement will work with the zscaler events, but not with msad no matter how I change the case statement. I would really appreciate someone explaining the disconnect I am experiencing.
You are mixing AND with OR without parentheses, which is always terrible, but the real problem is that eval
and where
treat *
as a string literal
. Check our or conference talk here:
https://www.youtube.com/watch?v=wAVnQIoH3Zc
In the meantime , try this:
((index=zscaler) OR (index=msad)) AND query="*debug*opendns*"
| eval field=case(index="msad" AND match(query, "debug"), "msad",
index="zscaler" AND query="debug.opendns.com", "Zscaler",
true(), "undefined")
| timechart span=1h count BY field
You are mixing AND with OR without parentheses, which is always terrible, but the real problem is that eval
and where
treat *
as a string literal
. Check our or conference talk here:
https://www.youtube.com/watch?v=wAVnQIoH3Zc
In the meantime , try this:
((index=zscaler) OR (index=msad)) AND query="*debug*opendns*"
| eval field=case(index="msad" AND match(query, "debug"), "msad",
index="zscaler" AND query="debug.opendns.com", "Zscaler",
true(), "undefined")
| timechart span=1h count BY field
Thanks so much! I'll definitely check it out!