Evaluate and Set Function
Details of the following evaluate and set function is available.
IF Function
IF(<expression>,<trueValue>,<falseValue>) evaluates the <expression> and returns <trueValue> if <expression> is true and <falseValue> if the <expression> is false.
Syntax
IF(<expression>,<trueValue>,<falseValue>)
- <expression> is a Boolean expression that evaluates to true or false. Currently expression can only be the following expressions joined by AND/OR:
<eventAttribute><Operator><ConstantValue> - <trueValue> is returned when <expression> evaluates to true – can be a string or an integer
- <falseValue> is returned when <expression> evaluates to false – can be a string or an integer
Note that nested functions is not supported for IF.
Scope
Available for ClickHouse and Elasticsearch queries from 7.0.0 onwards.
Example
Time |
eventType |
User |
IF(eventType=” Login-Success”,1,0) |
IF(eventType=” Login-Failure”,1,0) |
---|---|---|---|---|
T1 |
Login-Success |
User1 |
1 |
0 |
T2 |
Login-Success |
User2 |
1 |
0 |
T3 |
Login-Failure |
User1 |
0 |
1 |
T4 |
Login-Failure |
User1 |
0 |
1 |
T5 |
Login-Success |
User1 |
1 |
0 |
If you group by on User and then apply aggregate on the IF function, then you get the following result:
User |
SUM(IF(eventType=” Login-Success”,1,0)) |
SUM(IF(eventType=” Login-Failure”,1,0 |
---|---|---|
User1 |
2 |
2 |
User2 |
1 |
0 |