# Using CASE in DPL

**URL:** <https://community.dynatrace.com/t/using-case-in-dpl/48880>\
**Category:** Dynatrace Tips\
**Tags:** log-processing, dpl\
**Created:** [November 14, 2024, 1:21am UTC](https://community.dynatrace.com/t/using-case-in-dpl/48880 "2024-11-14T01:21:15Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![AntonioSousa](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/antoniosousa/32/50_2.png) [@AntonioSousa](https://community.dynatrace.com/u/AntonioSousa)\
**Post date:** [November 14, 2024, 1:21am UTC](https://community.dynatrace.com/t/using-case-in-dpl/48880/1 "2024-11-14T01:21:15Z")

</div>

When using DPL, namely in Logs Classic, we sometimes have to check and convert values.

One great example is converting trap severity OID values into their corresponding loglevel’s in Dynatrace.

I have managed to make my first conversion, and it goes like this:

```markup
USING (INOUT "CISCO-SMI::ciscoMgmt.311.1.1.2.1.17.0":STRING ) | FIELDS_ADD( loglevel: (
case
 when COLUMN("CISCO-SMI::ciscoMgmt.311.1.1.2.1.17.0") == '1' then 'CRITICAL'
 when COLUMN("CISCO-SMI::ciscoMgmt.311.1.1.2.1.17.0") == '2' then 'ERROR'
 when COLUMN("CISCO-SMI::ciscoMgmt.311.1.1.2.1.17.0") == '3' then 'SEVERE'
 when COLUMN("CISCO-SMI::ciscoMgmt.311.1.1.2.1.17.0") == '4' then 'WARN'
 when COLUMN("CISCO-SMI::ciscoMgmt.311.1.1.2.1.17.0") == '5' then 'NOTICE'
 when COLUMN("CISCO-SMI::ciscoMgmt.311.1.1.2.1.17.0") == '6' then 'INFO'
 else "NONE"
end
) )

```

While I still want to confirm if these loglevel’s are the best match, I believe it is pretty self-explanatory.  
BTW, the Cisco definition is:

```markup
1—Critical
2—Major
3—Minor
4—Warning
5—Clear
6—Info

```

Also, thanks for this great finding: [https://community.dynatrace.com/t5/Log-Analytics/Log-Processing-CASE-WHEN-THEN-ELSE-END-Documentation/m-p/258434](https://community.dynatrace.com/post/258434)