https://community.splunk.com/t5/Splunk-Search/how-to-assign-boolean-result-within-eval/m-p/287227#M86963 <P>How about this?</P> <PRE><CODE>|stats count |fields - count |eval country = "FR;DE;GE;AN;US" |eval country = split(country,";") |mvexpand country |eval tokenValue = 1 | eval toto = if(tokenValue ==1, if(country="FR",1,0), if(country!="FR",1,0)) </CODE></PRE> Thu, 22 Dec 2016 18:42:09 GMT richgalloway 2016-12-22T18:42:09Z https://community.splunk.com/t5/Splunk-Search/how-to-assign-boolean-result-within-eval/m-p/287226#M86962 <P>hi,</P> <P>I worked last week with Splunk 6.3.3 and upgraded to the latest version 6.5.</P> <P>I detected a problem with a search, when i try to assign a boolean result using eval function.<BR /> on the Splunk 6.3.3, it worked but not with 6.5</P> <P>this is my request :</P> <PRE><CODE>|stats count |fields - count |eval country = "FR;DE;GE;AN;US" |eval country = split(country,";") |mvexpand country |eval tokenValue = 1 | eval toto = if(tokenValue ==1, country="FR", country!="FR") </CODE></PRE> <P>the tokenValue get a dynamic value 0 or 1.<BR /> how can i search or filter my events based on tokenValue?</P> <P>here's a picture of the error message.</P> <P>thx<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2260iDC014EC3DB77B846/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Thu, 22 Dec 2016 17:35:00 GMT https://community.splunk.com/t5/Splunk-Search/how-to-assign-boolean-result-within-eval/m-p/287226#M86962 sfatnass 2016-12-22T17:35:00Z https://community.splunk.com/t5/Splunk-Search/how-to-assign-boolean-result-within-eval/m-p/287227#M86963 <P>How about this?</P> <PRE><CODE>|stats count |fields - count |eval country = "FR;DE;GE;AN;US" |eval country = split(country,";") |mvexpand country |eval tokenValue = 1 | eval toto = if(tokenValue ==1, if(country="FR",1,0), if(country!="FR",1,0)) </CODE></PRE> Thu, 22 Dec 2016 18:42:09 GMT https://community.splunk.com/t5/Splunk-Search/how-to-assign-boolean-result-within-eval/m-p/287227#M86963 richgalloway 2016-12-22T18:42:09Z