https://community.splunk.com/t5/Splunk-Search/Issue-with-if/m-p/33085#M7007 <P>The rule regarding strings vs numbers in quotes is true in most <CODE>where</CODE> and <CODE>eval</CODE> statements, but not in <CODE>search</CODE> statements.</P> Thu, 27 Jan 2011 00:29:58 GMT gkanapathy 2011-01-27T00:29:58Z https://community.splunk.com/t5/Splunk-Search/Issue-with-if/m-p/33081#M7003 <P>Hey everyone. I am working to try and take a call record, subtract the time a call was placed from the time it was answered. This much works. After that I am trying to take the resulting number, and if its less than 30 eval it into another column. Here's the code:</P> <PRE><CODE>index="sandbox" sourcetype="AS-CDR" |where Called_Number="2155551060" OR Calling_Number="2155551060" OR Called_Number="12155551060" OR Calling_Number="12155551060" OR Called_Number="+12155551060" OR Calling_Number="+12155551060" |eval TimeToAnswer=strptime(Answer_Time, "%Y%m%d%H%M%S.%q") - strptime(Start_Time, "%Y%m%d%H%M%S.%q") |eval TimeToAnswerTest=if((TimeToAnswer&lt;"30"),1,0) |table TimeToAnswer TimeToAnswerTest </CODE></PRE> <P>For some of the calls a result of 1 is seen when it should be. However for others, it isn't. Here are some example values that I'm getting back:</P> <P>TimeToAnswer~TimeToAnswerTest 67.151000~0 (correct) 8.930000~0 (incorrect) 2.568000~1 (correct) 5.115000~0 (incorrect) 3.341000~1 (correct)</P> <P>Any advice on what could be causing this would be extremely helpful. The numbers are being generated correctly, so I'm not sure why the if operator isn't always working correctly.</P> Thu, 27 Jan 2011 00:02:13 GMT https://community.splunk.com/t5/Splunk-Search/Issue-with-if/m-p/33081#M7003 msarro 2011-01-27T00:02:13Z https://community.splunk.com/t5/Splunk-Search/Issue-with-if/m-p/33082#M7004 <P>I believe it is the "s around the 30.</P> <P>Try </P> <PRE><CODE>index="sandbox" sourcetype="AS-CDR" |where Called_Number="2155551060" OR Calling_Number="2155551060" OR Called_Number="12155551060" OR Calling_Number="12155551060" OR Called_Number="+12155551060" OR Calling_Number="+12155551060" |eval TimeToAnswer=strptime(Answer_Time, "%Y%m%d%H%M%S.%q") - strptime(Start_Time, "%Y%m%d%H%M%S.%q") |eval TimeToAnswerTest=if((TimeToAnswer&lt;30),1,0) |table TimeToAnswer TimeToAnswerTest </CODE></PRE> Thu, 27 Jan 2011 00:08:19 GMT https://community.splunk.com/t5/Splunk-Search/Issue-with-if/m-p/33082#M7004 vaijpc 2011-01-27T00:08:19Z https://community.splunk.com/t5/Splunk-Search/Issue-with-if/m-p/33083#M7005 <P>That worked perfectly. When you use quotes, does splunk process the contents of the quotes as a string as opposed to an integer/float?</P> Thu, 27 Jan 2011 00:21:04 GMT https://community.splunk.com/t5/Splunk-Search/Issue-with-if/m-p/33083#M7005 msarro 2011-01-27T00:21:04Z https://community.splunk.com/t5/Splunk-Search/Issue-with-if/m-p/33084#M7006 <P>I'm guessing that's the case, it certainly sounds sensible. I'm afraid I'm a newbie too though. FYI, those brackets around the test are also unnecessary.</P> Thu, 27 Jan 2011 00:23:10 GMT https://community.splunk.com/t5/Splunk-Search/Issue-with-if/m-p/33084#M7006 vaijpc 2011-01-27T00:23:10Z https://community.splunk.com/t5/Splunk-Search/Issue-with-if/m-p/33085#M7007 <P>The rule regarding strings vs numbers in quotes is true in most <CODE>where</CODE> and <CODE>eval</CODE> statements, but not in <CODE>search</CODE> statements.</P> Thu, 27 Jan 2011 00:29:58 GMT https://community.splunk.com/t5/Splunk-Search/Issue-with-if/m-p/33085#M7007 gkanapathy 2011-01-27T00:29:58Z