topic Re: If statement will not evaluate as true in Splunk Search

Why won't If statement evaluate as true?

anjuliwyles — Wed, 11 Jan 2023 17:23:55 GMT

When I place event.code into an if statement, it will not evaluate as true

Currently I have this code:

index = windows-security event.code IN (4624)
| eval Success=if(event.code = "4624", 1, 0)
| stats count by Success

Success always evaluates to 0. I have tried using

match(event.code, "4624")

match(event.code, '4624')

match(event.code, ".+")

like(event.code, "4624")

like(event.code, '4624')

I even tried event.code = event.code

Always 0.

richgalloway — Tue, 10 Jan 2023 14:44:43 GMT

Since event.code probably is an integer have you tried

| eval Success=if(event.code = 4624, 1, 0)

It's possible Splunk is struggling with the field name. Try renaming it before the conditional.

| rename event.* as * | eval Success = if(code=4624, 1, 0)

anjuliwyles — Tue, 10 Jan 2023 14:53:03 GMT

Renaming the field worked! Thank you