case()

The case() function evaluates condition-value pairs in order and returns the value corresponding to the first condition that evaluates to true. If no condition is true, it optionally returns a default value.

Syntax

Parameters

COND1, COND2, ...

Condition expressions evaluated in order. What counts as a true condition differs by series. In the 5.0 series (through 5.0.2605.2), boolean true or any non-null value is treated as true — only null and boolean false are treated as false. In the 4.0 series starting with 4.0.2609.0, null, boolean false, the numbers 0 and NaN, an empty string, and an empty list, array, or map are all treated as false, and every other value is treated as true; you must also specify at least one condition-value (COND, VAL) pair, or a parse error occurs (see Error codes).

VAL1, VAL2, ...

Value expressions to return when the corresponding condition is treated as true. Each value is paired with its corresponding condition.

DEFAULT

(Optional) The default value to return when all conditions are treated as false. If the total number of arguments is odd, the last argument is used as the default value.

Description

The case() function evaluates conditions in the order COND1, COND2, ..., determining whether each is true or false. When a condition is treated as true, the function immediately returns its corresponding value without evaluating further conditions.

If no condition is true, the function returns the DEFAULT value if specified, or null if no default is provided.

If a condition is treated as false, evaluation continues to the next condition.

The return type is determined by the type of the value expression that was actually evaluated. If the value expressions have different types, the result is automatically promoted to a common supertype (for example, a mix of integer and float values returns a float).

Error codes

Usage examples

To prepare the WEB_APACHE_SAMPLE table used in these examples, refer to Preparing sample data.

1. Classify HTTP status codes into labels by range

   table limit=5 WEB_APACHE_SAMPLE
   | eval label = case(status >= 500, "Server Error", status >= 400, "Client Error", status >= 300, "Redirect", "OK")
   | fields status, label
   | # label is determined based on the status value.
   

2. Classify by HTTP method

   table limit=5 WEB_APACHE_SAMPLE
   | eval type = case(method == "GET", "Read", method == "POST", "Submit", method == "OPTIONS", "Preflight", "Other")
   | fields method, type
   

3. No condition matches and no default is provided

   json "{'val': 0}" | eval result = case(val == 1, "one", val == 2, "two")
   | # result: null
   

4. NULL input — null is treated as false during condition evaluation, so the default value is returned

   json "{'val': null}" | eval result = case(val == 1, "one", "default")
   | # result: default
   

5. Using the number 0 as a condition — result differs by series

   json "{'val': 0}" | eval result = case(val, "true", "false")
   | # 5.0 series (through 5.0.2605.2) result: true / 4.0 series (4.0.2609.0 and later) result: false
   

   Whether the number 0 is treated as a true or false condition differs by series. In the 5.0 series (through 5.0.2605.2), any non-null value, including 0, is treated as true, so this example returns "true". In the 4.0 series starting with 4.0.2609.0, the number 0 is treated as false, so the default value ("false") is returned instead.

6. Calling without any condition-value pair — parse error in 4.0.2609.0 and later)

   json "{}" | eval result = case()
   

   In the 4.0 series starting with 4.0.2609.0, because no condition-value pair is specified, a parse error (error code 99000) occurs before the query runs. The 5.0 series (through 5.0.2605.2) does not validate the argument count at parse time, so parsing succeeds; the result then depends on the execution path — the vectorized execution path fails with an error (NullPointerException), while the row-based execution path returns null without an error.

Change history