Add a Field Based on Values of Another Field - Example 2

Derive new fields from existing values (success indicators) using nested if() functions

Query

logscale
| success := if(status >= 500, then=0, else=if(status == 404, then=0, else=1))

Introduction

Another example of nested if() functions: this is used to add a field success whose value is calculated based on field status.

Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    | success := if(status >= 500, then=0, else=if(status == 404, then=0, else=1))

    Adds a success field at the following conditions:

    • Sets the value of field success to 0 if status is greater or equal to 500 or if it's equal to 400, otherwise:

    • Sets the value of field success to 1.

  3. Event Result set.

Summary and Results

Nested if() functions for tagging a field according to different status values.