https://community.splunk.com/t5/Splunk-Search/EVALstatement-not-working/m-p/317827#M95099 <P>My eval statement below is to check if 'Action is Required' only if the below conditions are met, I have also used case and if statement to determine this, however none of these have worked.</P> <UL> <LI>Location does not equal Varonis (i.e equals Not in Varonis)</LI> <LI>MonitoringStatus does not equal Monitored (i.e equals Not Monitored)</LI> <LI>Contains the word "Hosting" in the Path field</LI> </UL> <P>| eval VaronisStatus=if(('(g)Location'!="Varonis" AND(MonitoringStatus!="Monitored") AND like(Path,"%Hosting%")),"Action Required", "No Action Required") </P> <P>|| eval VaronisStatus=case(('(g)Location'!="Varonis" AND(MonitoringStatus!="Monitored") AND like(Path,"%Hosting%")),"Action Required" , 1=1,"No Action Required") </P> Wed, 17 Jan 2018 13:06:51 GMT davidcraven02 2018-01-17T13:06:51Z https://community.splunk.com/t5/Splunk-Search/EVALstatement-not-working/m-p/317827#M95099 <P>My eval statement below is to check if 'Action is Required' only if the below conditions are met, I have also used case and if statement to determine this, however none of these have worked.</P> <UL> <LI>Location does not equal Varonis (i.e equals Not in Varonis)</LI> <LI>MonitoringStatus does not equal Monitored (i.e equals Not Monitored)</LI> <LI>Contains the word "Hosting" in the Path field</LI> </UL> <P>| eval VaronisStatus=if(('(g)Location'!="Varonis" AND(MonitoringStatus!="Monitored") AND like(Path,"%Hosting%")),"Action Required", "No Action Required") </P> <P>|| eval VaronisStatus=case(('(g)Location'!="Varonis" AND(MonitoringStatus!="Monitored") AND like(Path,"%Hosting%")),"Action Required" , 1=1,"No Action Required") </P> Wed, 17 Jan 2018 13:06:51 GMT https://community.splunk.com/t5/Splunk-Search/EVALstatement-not-working/m-p/317827#M95099 davidcraven02 2018-01-17T13:06:51Z https://community.splunk.com/t5/Splunk-Search/EVALstatement-not-working/m-p/317828#M95100 <P>Hi @davidcraven02,<BR /> I have checked below and it works fine</P> <PRE><CODE> &lt;base search&gt;| eval VaronisStatus=if('(g)Location'!="Varonis" AND MonitoringStatus!="Monitored" AND like(Path,"%Hosting%"),"Action Required", "No Action Required") </CODE></PRE> <P>Could you please tell me situation where its not working as expected..</P> Wed, 17 Jan 2018 17:30:41 GMT https://community.splunk.com/t5/Splunk-Search/EVALstatement-not-working/m-p/317828#M95100 493669 2018-01-17T17:30:41Z