https://community.splunk.com/t5/Splunk-Search/Need-Help-with-Splunk-Alert/m-p/709384#M239746 <P>Try using the <FONT face="courier new,courier">match</FONT> function to test the field value.</P><LI-CODE lang="markup">index=XXX_XXX_XXX | eval job_status=if(match('MSGTXT', "ABEND"),"ko","ok") | where job_status="ko"</LI-CODE><P>&nbsp;</P> Wed, 22 Jan 2025 00:49:47 GMT richgalloway 2025-01-22T00:49:47Z https://community.splunk.com/t5/Splunk-Search/Need-Help-with-Splunk-Alert/m-p/709368#M239740 <P>I need help with below splunk query</P> <P>&nbsp;</P> <LI-CODE lang="markup">index=XXX_XXX_XXX | eval job_status=if( 'MSGTXT' = "*ABEND*","ko","ok") | where job_status="ko"</LI-CODE> <P>&nbsp;</P> <P>If I change job_status="ok" its working but not for above condition, appreciate any suggestion on this.</P> <P>&nbsp;</P> <P>Regards</P> <P>&nbsp;</P> Wed, 22 Jan 2025 15:07:22 GMT https://community.splunk.com/t5/Splunk-Search/Need-Help-with-Splunk-Alert/m-p/709368#M239740 Amit79 2025-01-22T15:07:22Z https://community.splunk.com/t5/Splunk-Search/Need-Help-with-Splunk-Alert/m-p/709384#M239746 <P>Try using the <FONT face="courier new,courier">match</FONT> function to test the field value.</P><LI-CODE lang="markup">index=XXX_XXX_XXX | eval job_status=if(match('MSGTXT', "ABEND"),"ko","ok") | where job_status="ko"</LI-CODE><P>&nbsp;</P> Wed, 22 Jan 2025 00:49:47 GMT https://community.splunk.com/t5/Splunk-Search/Need-Help-with-Splunk-Alert/m-p/709384#M239746 richgalloway 2025-01-22T00:49:47Z