https://community.splunk.com/t5/Splunk-Search/Where-and-eval-weirdness/m-p/47553#M11348 <P>Hey @Lowell can you select your answer? </P> Fri, 01 Mar 2019 21:58:37 GMT ryhluc01 2019-03-01T21:58:37Z https://community.splunk.com/t5/Splunk-Search/Where-and-eval-weirdness/m-p/47551#M11346 <P>I have a multi-value field called <CODE>TotalRows</CODE> (which is in contains a list of values in time order) and I'm trying to determine when the last value is less than the first value as a simple means to detect decreasing trend in the field....</P> <P>This approach works:</P> <PRE><CODE>... | eval first_rows=mvindex(TotalRows,0) | eval last_rows=mvindex(TotalRows,-1) | where first_rows&gt;last_rows </CODE></PRE> <P>But when I simply this expression and remove the extra (unwanted) fields, it doesn't work:</P> <PRE><CODE>... | where mvindex(TotalRows,0) &gt; mvindex(TotalRows,-1) </CODE></PRE> <P>Any ideas?</P> Sat, 19 Feb 2011 08:16:19 GMT https://community.splunk.com/t5/Splunk-Search/Where-and-eval-weirdness/m-p/47551#M11346 Lowell 2011-02-19T08:16:19Z https://community.splunk.com/t5/Splunk-Search/Where-and-eval-weirdness/m-p/47552#M11347 <P>Hmm, think I figured it out.</P> <P>It looks like <CODE>mvindex</CODE> must always consider it's return value to be a string. Therefore, forcing it to a number allows the single expression to work:</P> <PRE><CODE>... | where tonumber(mvindex(TotalRows,0)) &gt; tonumber(mvindex(TotalRows,-1)) </CODE></PRE> Sat, 19 Feb 2011 08:20:37 GMT https://community.splunk.com/t5/Splunk-Search/Where-and-eval-weirdness/m-p/47552#M11347 Lowell 2011-02-19T08:20:37Z https://community.splunk.com/t5/Splunk-Search/Where-and-eval-weirdness/m-p/47553#M11348 <P>Hey @Lowell can you select your answer? </P> Fri, 01 Mar 2019 21:58:37 GMT https://community.splunk.com/t5/Splunk-Search/Where-and-eval-weirdness/m-p/47553#M11348 ryhluc01 2019-03-01T21:58:37Z