https://community.splunk.com/t5/Splunk-Search/String-validation-in-eval-command/m-p/88779#M22723 <P>Yes I have used it but still it did't work for me <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> Tue, 09 Apr 2013 20:05:49 GMT marellasunil 2013-04-09T20:05:49Z https://community.splunk.com/t5/Splunk-Search/String-validation-in-eval-command/m-p/88777#M22721 <P>Eval is not validating "string" proparly, means status=Normal is not validating. It is perfectly working for numaric values.<BR /> Ex : .. | eval AlertStatus=if(status="Normal", "Ok", "Not Ok") <BR /> for every Status it is displying OK.</P> Tue, 09 Apr 2013 19:48:35 GMT https://community.splunk.com/t5/Splunk-Search/String-validation-in-eval-command/m-p/88777#M22721 marellasunil 2013-04-09T19:48:35Z https://community.splunk.com/t5/Splunk-Search/String-validation-in-eval-command/m-p/88778#M22722 <P>You should use double equals signs.</P> <PRE><CODE>... | eval AlertStatus=if(status=="Normal","Ok","Not Ok") </CODE></PRE> Tue, 09 Apr 2013 19:59:36 GMT https://community.splunk.com/t5/Splunk-Search/String-validation-in-eval-command/m-p/88778#M22722 Ayn 2013-04-09T19:59:36Z https://community.splunk.com/t5/Splunk-Search/String-validation-in-eval-command/m-p/88779#M22723 <P>Yes I have used it but still it did't work for me <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> Tue, 09 Apr 2013 20:05:49 GMT https://community.splunk.com/t5/Splunk-Search/String-validation-in-eval-command/m-p/88779#M22723 marellasunil 2013-04-09T20:05:49Z https://community.splunk.com/t5/Splunk-Search/String-validation-in-eval-command/m-p/88780#M22724 <P>Yes I have used it but still it did't work for me <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> Tue, 09 Apr 2013 20:06:13 GMT https://community.splunk.com/t5/Splunk-Search/String-validation-in-eval-command/m-p/88780#M22724 marellasunil 2013-04-09T20:06:13Z