How to return field values from an eval/if statement

[RickGenesis]

I am trying to return change data for our servers. basically I import the list of open changes from the change control system, I then run a search (it will be a macro once it works) that checks if the specified server is currently in a change window,if it is it returns the change number if not it returns "operational"

 sourcetype=RFClist Change_Status!=Draft OR Change_Status!=Closed Details="*serverA*" earliest=0 latest=now 
| where time() > strptime(Change_Start_Date, "%F %T") AND time() < strptime(Change_End_Date, "%F %T") 
| stats count as window 
| eval window=if(window==0,"Operational",Change_Number)

when I use a server that is not in a change window I get the "Operational" output, but when I use a server that is in a change window I get nothing. If I just use strings in the eval/if statement I get valid output.

anyone got any ideas?

[kristian_kolb]

The eval/if looks fine. However, I'm thinking that you'd want to use _time rather than time() in the where statement

/k

[kristian_kolb]

Oh, then perhaps the Change_Number does not have a value, i.e. is null?

[RickGenesis]

_time is the time of the returned events, I am checking if the returned events (changes) are currently(ie now) active. I believe the search statement is correct as if I replace the change_number field with a string e.g "in change" it works perfectly, except I really wanted the change number as part of the output.