Kusto - If else condition with Kusto

Question

I am trying to convert the below Splunk query to Kusto.

| eval result=if(Match(Status,"Success|Passed"), "succeess","failed")

Below is the example from Kusto that is not clear . How do I modify this Kusto example as per the above Splunk Query pls. Thanks | extend day = iff(floor(Timestamp, 1d)==floor(now(), 1d), "today", "anotherday")

Answer 1

You could try this:

... 
| summarize success = countif(Status in ("Success", "Passed")), total = count() 
| project success, failure = total - success

• in case the values in the column named Status can have different casing, you can use in~()

• in case the values in the column named Status are longer strings, which you want to look for substring in, you can use, for example: Status contains "Success" or Status contains "Passed"