I have set of events as below:
EmployeeID Company
C123 ABC
C456 DEF
C789
2598
3648
Here, all the EmployeeID starting with C are Contractors and some of them have Company values. Now I want to achieve 2 things
1. I want to Populate "Unknown" where the EmployeeID starts with C but there is no Company value.
2. And for all the other EmployeeID (not starting with C), I want to populate Fulltime.
Thanks in advance!!
This should help.
... | eval Company = case(isnotnull(Company), Company, match(EmployeeID, "C.*"), "Unknown", 1==1, "Fulltime")
This should help.
... | eval Company = case(isnotnull(Company), Company, match(EmployeeID, "C.*"), "Unknown", 1==1, "Fulltime")
Thanks a lot, it worked for me.
I was trying to implement nested loop but it was giving me an error about malformed function or repeatable action. Thanking again for help!!