Try this
base search term
| eval varA = fieldA/3
| eval varB = fieldB/36
| eval varC = varA * varB
| table Name varA varB varC
| eval Performance=if(varC>=SomeNumberHere,"Message1Here","Message2Here")
Now if you could explain what values should varA varB and varC should contain if aggregation needs to be done, we can include a stats command instead of table command. E.g. like you want to do max of varA and varB and sum of varC, just replace | table Name varA varB varC in above query with | stats max(varA) as varA max(varB) as varB sum(varC) as varC by Name .
... View more