Splunk if output reverse

[ashutoshc21]

I am doing eval response = if ("msg.RESPONSE"="200", "Success", "Fail" ), and I have all msg.RESPONSE as 200 but still i get Fail in output. As per splunk docs, value after condition should be returned if condition is true but it's reverse in my case. The logs are in JSON format like below

msg.RESPONSE : 200

[ITWhisperer]

Use single quotes around the field name e.g. 'msg.RESPONSE' otherwise you are just comparing two static strings and they are not equal.