Issue with if()?

[msarro]

Hey everyone. I am working to try and take a call record, subtract the time a call was placed from the time it was answered. This much works. After that I am trying to take the resulting number, and if its less than 30 eval it into another column. Here's the code:

index="sandbox" sourcetype="AS-CDR" 
|where Called_Number="2155551060" OR Calling_Number="2155551060" OR Called_Number="12155551060" OR Calling_Number="12155551060" OR Called_Number="+12155551060" OR Calling_Number="+12155551060"
|eval TimeToAnswer=strptime(Answer_Time, "%Y%m%d%H%M%S.%q") - strptime(Start_Time, "%Y%m%d%H%M%S.%q")
|eval TimeToAnswerTest=if((TimeToAnswer<"30"),1,0)
|table TimeToAnswer TimeToAnswerTest

For some of the calls a result of 1 is seen when it should be. However for others, it isn't. Here are some example values that I'm getting back:

TimeToAnswer~TimeToAnswerTest 67.151000~0 (correct) 8.930000~0 (incorrect) 2.568000~1 (correct) 5.115000~0 (incorrect) 3.341000~1 (correct)

Any advice on what could be causing this would be extremely helpful. The numbers are being generated correctly, so I'm not sure why the if operator isn't always working correctly.

[vaijpc · Accepted solution]

I believe it is the "s around the 30.

Try

index="sandbox" sourcetype="AS-CDR" 
|where Called_Number="2155551060" OR Calling_Number="2155551060" OR Called_Number="12155551060" OR Calling_Number="12155551060" OR Called_Number="+12155551060" OR Calling_Number="+12155551060"
|eval TimeToAnswer=strptime(Answer_Time, "%Y%m%d%H%M%S.%q") - strptime(Start_Time, "%Y%m%d%H%M%S.%q")
|eval TimeToAnswerTest=if((TimeToAnswer<30),1,0)
|table TimeToAnswer TimeToAnswerTest

[gkanapathy]

The rule regarding strings vs numbers in quotes is true in most where and eval statements, but not in search statements.

[vaijpc]

I'm guessing that's the case, it certainly sounds sensible. I'm afraid I'm a newbie too though. FYI, those brackets around the test are also unnecessary.

[msarro]

That worked perfectly. When you use quotes, does splunk process the contents of the quotes as a string as opposed to an integer/float?