What is the difference between == and = in SPL ?

[HeinzWaescher]

Hi,

I've seen it several times but don't know the difference and when to use == instead of = .
Like in these samples from the docs:

1. | eval description=case(status == 200, "OK", status ==404, "Not found", status == 500, "Internal Server Error")

2. | eval action=if(action=="view",...)

Thanks in advance

[richgalloway · Accepted solution]

The == operator means "is equal to". The = operator means either "is equal to" or "is assigned to" depending on the context.
Either operator can be used to compare two fields/values with == more clearly indicating a comparison rather than an assignment.
Use = to assign a value to a field.

[HeinzWaescher]

Thanks a lot. I never used == and never ran into problems, that's why I was wondering.
So in the end it is more a cosmetical thing to use ==.