CODEWITHSUNDEEP
azure-data-explorerkqlkusto-explorer
Milo_Dev
Milo_Dev

Reputation: 415

Kusto - If else condition with Kusto

I am trying to convert the below Splunk query to Kusto.

| eval result=if(Match(Status,"Success|Passed"), "succeess","failed")

Below is the example from Kusto that is not clear . How do I modify this Kusto example as per the above Splunk Query pls. Thanks | extend day = iff(floor(Timestamp, 1d)==floor(now(), 1d), "today", "anotherday")

enter image description here

Upvotes: 4

Views: 16546

Answers (1)

Yoni L.
Yoni L.

Reputation: 25895

You could try this:

... 
| summarize success = countif(Status in ("Success", "Passed")), total = count() 
| project success, failure = total - success

  • in case the values in the column named Status can have different casing, you can use in~()

  • in case the values in the column named Status are longer strings, which you want to look for substring in, you can use, for example: Status contains "Success" or Status contains "Passed"

Upvotes: 2

Related Questions