Good Day,
I'm attempting to create a label for different search responses.
Example:
if search 'A' finds error "500", Field B. is populated with "test1"
if search 'A' finds error "400", Field B. is populated with "test2"
and soo on.
You could do something like this:
... | eval B = case(search finds error "500", "test1", search finds error "400", "test2)
thanks. any idea how to tell it to only display if 400 are greater than 350 count?