Splunk Search

Splunk if output reverse

ashutoshc21
Engager

I am doing eval response = if ("msg.RESPONSE"="200", "Success", "Fail" ), and I have all msg.RESPONSE as 200 but still i get Fail in output. As per splunk docs, value after condition should be returned if condition is true but it's reverse in my case. The logs are in JSON format like below

msg.RESPONSE : 200

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Use single quotes around the field name e.g. 'msg.RESPONSE' otherwise you are just comparing two static strings and they are not equal.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...