topic Re: What is the difference between == and = in SPL ? in Splunk Search

What is the difference between == and = in SPL ?

HeinzWaescher — Tue, 19 Nov 2019 13:39:47 GMT

Hi,

I've seen it several times but don't know the difference and when to use == instead of = .
Like in these samples from the docs:

| eval description=case(status == 200, "OK", status ==404, "Not found", status == 500, "Internal Server Error")
| eval action=if(action=="view",...)

Thanks in advance

Re: What is the difference between == and = in SPL ?

richgalloway — Tue, 19 Nov 2019 13:51:13 GMT

The == operator means "is equal to". The = operator means either "is equal to" or "is assigned to" depending on the context.
Either operator can be used to compare two fields/values with == more clearly indicating a comparison rather than an assignment.
Use = to assign a value to a field.

Re: What is the difference between == and = in SPL ?

HeinzWaescher — Tue, 19 Nov 2019 14:04:52 GMT

Thanks a lot. I never used == and never ran into problems, that's why I was wondering.
So in the end it is more a cosmetical thing to use ==.