topic Re: Why is my "eval field=if()" search returning TRUE or FALSE instead of a numeric value? in Splunk Search

Why is my "eval field=if()" search returning TRUE or FALSE instead of a numeric value?

andrei1bc — Tue, 02 Feb 2016 13:09:17 GMT

Hi.

I am trying to search across multiple indexes. The field I am looking for is Value (and has only numbers). This value must not contain any decimals, and in case the sourcetype is sourcetype1, then the value must be recalculated as (Value-100)*-1.

My search:

index=*  sourcetype="sourcetype1" OR source=source2 | eval Value=if(sourcetype="sourcetype1", Value=round(((Value-100)*-1), 0), Value=round(Value, 0))

The result I get is either True or False for the Value field. What am I doing wrong?

Thank you in advance.

Re: Why is my "eval field=if()" search returning TRUE or FALSE instead of a numeric value?

andrei1bc — Tue, 02 Feb 2016 13:23:32 GMT

forgot to mention that there is no event in any index that has the sourcetype=sourcetype1 and source=source2
sourcetype=sourcetype1 events are stored in index1
source=source2 events are stored in index2
searching by value and applying the same type of condition returns me the same TRUE / FALSE results

Re: Why is my "eval field=if()" search returning TRUE or FALSE instead of a numeric value?

richgalloway — Tue, 02 Feb 2016 13:24:25 GMT

Your if command is returning comparisons instead of values. Try

index= sourcetype="sourcetype1" OR source=source2 | eval Value=if(sourcetype="sourcetype1", round(((Value-100)-1), 0), round(Value, 0))

Re: Why is my "eval field=if()" search returning TRUE or FALSE instead of a numeric value?

javiergn — Tue, 02 Feb 2016 13:32:19 GMT

I've just deleted my answer as @richgalloway already provided you with a valid one