You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
sql: "SELECT REPLACE(message, 'foo', 'bar') AS updated FROM logs",
327
327
expected: "* | format \"<message>\" as updated | replace ('foo', 'bar') at updated | fields updated",
328
328
},
329
+
{
330
+
name: "case expression",
331
+
sql: `SELECT CASE
332
+
WHEN score >= 90 THEN 'critical'
333
+
WHEN score >= 75 THEN 'high'
334
+
WHEN score >= 50 THEN 'medium'
335
+
WHEN score >= 25 THEN 'low'
336
+
ELSE 'info'
337
+
END AS severity FROM logs`,
338
+
expected: "* | format \"info\" as severity | format if (score:>=25) \"low\" as severity | format if (score:>=50) \"medium\" as severity | format if (score:>=75) \"high\" as severity | format if (score:>=90) \"critical\" as severity | fields severity",
339
+
},
340
+
{
341
+
name: "case expression with operand",
342
+
sql: "SELECT CASE level WHEN 'error' THEN 'critical' WHEN 'warn' THEN 'warning' ELSE 'info' END AS sev FROM logs",
343
+
expected: "* | format \"info\" as sev | format if (level:warn) \"warning\" as sev | format if (level:error) \"critical\" as sev | fields sev",
344
+
},
329
345
{
330
346
name: "json value simple path with alias",
331
347
sql: "SELECT JSON_VALUE(payload, '$.ip') AS ip FROM logs",
0 commit comments