Hi Guys,
So I am trying to use the "compare" expression to change field values.
The problem I am currently facing is that only the first case value works, all the others goes to "other" (default).
In this example, only the first "User name does not exist" works.
Is this a bug?
| mapColumn winlog.event_data.SubStatus
fn={getCell winlog.event_data.SubStatus | switch {case if={compare eq to="0xc0000064"} then="User name does not exist"} {case if={compare eq to="0xc000006a"} then="User name is correct but the password is wrong"} {case if={compare eq to="0xc0000234"} then="User" "is" "currently" "locked" "out"} {case if={compare eq to="0xc0000072"} then="Account" "is" "currently" "disabled"} {case if={compare eq to="0xc000006F"} then="User" "tried" "to" "logon" "outside" "his" "time" "restrictions"} {case if={compare eq to="0xc0000070"} then="Workstation restriction, or Authentication Policy Silo violation (look for event ID 4820 on domain controller"} {case if={compare eq to="0xc0000193"} then="Account expiration"} {case if={compare eq to="0xc0000071"} then="Expired password"} {case if={compare eq to="0xc0000133"} then="Clocks between DC and other computer too far out of sync"} {case if={compare eq to="0xc0000224"} then="User is required to change password at next logon"} {case if={compare eq to="0xc0000225"} then="Evidently a bug in Windows and not a risk"} {case if={compare eq to="0xc000015b"} then="The user has not been granted the requested logon type (aka logon right) at this machine"} default="other"}