https://community.splunk.com/t5/Splunk-Search/Splunk-if-output-reverse/m-p/573452#M199835 <P>I am doing&nbsp;eval response = if ("msg.RESPONSE"="200", "Success", "Fail" ), and I have all msg.RESPONSE as 200 but still i get Fail in output. As per splunk docs, value after condition should be returned if condition is true but it's reverse in my case. The logs are in JSON format like below</P><P>msg.RESPONSE : 200</P> Wed, 03 Nov 2021 08:27:46 GMT ashutoshc21 2021-11-03T08:27:46Z https://community.splunk.com/t5/Splunk-Search/Splunk-if-output-reverse/m-p/573452#M199835 <P>I am doing&nbsp;eval response = if ("msg.RESPONSE"="200", "Success", "Fail" ), and I have all msg.RESPONSE as 200 but still i get Fail in output. As per splunk docs, value after condition should be returned if condition is true but it's reverse in my case. The logs are in JSON format like below</P><P>msg.RESPONSE : 200</P> Wed, 03 Nov 2021 08:27:46 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-if-output-reverse/m-p/573452#M199835 ashutoshc21 2021-11-03T08:27:46Z https://community.splunk.com/t5/Splunk-Search/Splunk-if-output-reverse/m-p/573455#M199838 <P>Use single quotes around the field name e.g. 'msg.RESPONSE' otherwise you are just comparing two static strings and they are not equal.</P> Wed, 03 Nov 2021 08:46:23 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-if-output-reverse/m-p/573455#M199838 ITWhisperer 2021-11-03T08:46:23Z