SO I am using an EVAL command in one of my searches in order to name process state as "OK" or "DOWN". This is my Query:
sourcetype=WMI:Service Name=VMTools | dedup host,Name | eval State = if(State == Running, "OK","DOWN") | table _time,host,Name,State
When I do I get the process is down, even if it's running. Please take a look at the image:
Now when I remove the "EVAL" Statement in the query above, it looks just fine. This is the query I am using:
sourcetype=WMI:Service Name=VMTools | dedup host,Name | table _time,host,Name,State
This is the image for the results no less than 1 minute after the previous image:
I am just wondering if I am doing something wrong? I checked the documentation, but I haven't seen this behavior before. I've been looking at this for awhile, and I'm wondering if there is a simple syntax error i'm overlooking?