Run the condition on multiple fields of each events

[khojas02]

I have set of events as below:

EmployeeID Company
C123 ABC
C456 DEF
C789
2598
3648

Here, all the EmployeeID starting with C are Contractors and some of them have Company values. Now I want to achieve 2 things
1. I want to Populate "Unknown" where the EmployeeID starts with C but there is no Company value.
2. And for all the other EmployeeID (not starting with C), I want to populate Fulltime.

Thanks in advance!!

[richgalloway · Accepted solution]

This should help.

... | eval Company = case(isnotnull(Company), Company, match(EmployeeID, "C.*"), "Unknown", 1==1, "Fulltime")

[khojas02]

Thanks a lot, it worked for me.

I was trying to implement nested loop but it was giving me an error about malformed function or repeatable action. Thanking again for help!!