Funkyness with Eval

[tmarlette]

SO I am using an EVAL command in one of my searches in order to name process state as "OK" or "DOWN". This is my Query:

 sourcetype=WMI:Service Name=VMTools | dedup host,Name | eval State = if(State == Running, "OK","DOWN") | table _time,host,Name,State

When I do I get the process is down, even if it's running. Please take a look at the image:

Now when I remove the "EVAL" Statement in the query above, it looks just fine. This is the query I am using:

sourcetype=WMI:Service Name=VMTools | dedup host,Name | table _time,host,Name,State

This is the image for the results no less than 1 minute after the previous image:

I am just wondering if I am doing something wrong? I checked the documentation, but I haven't seen this behavior before. I've been looking at this for awhile, and I'm wondering if there is a simple syntax error i'm overlooking?

[aelliott · Accepted solution]

perhaps quotation marks around "Running"?
It may be looking for the field named Running.

[tmarlette]

Oh... My... God..... I feel completely inadequate. Thank you very much sir!

so long... everything looks the same!!

[tmarlette]

Running a search on every service on that machine WITH the EVAL statement, it shows every service as "DOWN".