Need Help with Splunk Alert

[Amit79]

I need help with below splunk query

index=XXX_XXX_XXX
| eval job_status=if( 'MSGTXT' = "*ABEND*","ko","ok")
| where job_status="ko"

If I change job_status="ok" its working but not for above condition, appreciate any suggestion on this.

Regards

[richgalloway]

Try using the match function to test the field value.

index=XXX_XXX_XXX
| eval job_status=if(match('MSGTXT', "ABEND"),"ko","ok")
| where job_status="ko"