topic with the same search conditions, I cannot make eval if function to return true... in Splunk Search

with the same search conditions, I cannot make eval if function to return true...

leonjxtan — Mon, 08 May 2017 12:08:25 GMT

For some use case, I need to make a new true/false field.

Below condition returns 11 events in my data sample:
| from datamodel:"SomeDataModel.SomeDataSet" |search LocalField1=ABC AND CalculatedField2!=0

But if I write it with Eval and if functions like below, it returns no event:
| from datamodel:"SomeDataModel.SomeDataSet" |eval truefalseField1=if((LocalField1=ABC AND CalculatedField2!=0),true,false)
|search truefalseField1=true

How can I make the 2nd search also return same (11) events? Could you please help?

Thanks.

Re: with the same search conditions, I cannot make eval if function to return true...

leonjxtan — Mon, 08 May 2017 12:09:53 GMT

this is actually splunk-enterprise question, but after I click the Splunk Enterprise button and then click the “Post Your Question” button, it gives me error: The following topics are not present in the system, and you don't have permissions to create new ones: splunk-enterprise

Re: with the same search conditions, I cannot make eval if function to return true...

rjthibod — Mon, 08 May 2017 12:12:56 GMT

The values true and false are not recognized values. You have to use either the strings values "true" and "false" or use numbers 1 and 0.

For example

| from datamodel:"SomeDataModel.SomeDataSet" |eval truefalseField1=if((LocalField1=ABC AND CalculatedField2!=0),1,0) | search truefalseField1=1

Re: with the same search conditions, I cannot make eval if function to return true...

cmerriman — Mon, 08 May 2017 12:13:13 GMT

have you tried putting everything in quotations that isn't a number?

| from datamodel:"SomeDataModel.SomeDataSet" |eval truefalseField1=if((LocalField1="ABC" AND CalculatedField2!=0),"true","false") 
|search truefalseField1="true"

Re: with the same search conditions, I cannot make eval if function to return true...

leonjxtan — Tue, 09 May 2017 01:46:10 GMT

found reason why. It is that only when in eval statement, the CalculatedField2 failed to return any value. but in the first statement, the calculated field worked fine.