Why can't I search field values created in eval?

[michaeler]

I have a field called "Node_ID" that I extracted from another field "issue" that is formatted as N1234. There were some events that didn't fit and couldn't extract normally so I used eval to identify them.

| eval Node_ID=if(like(issue, "WC SVR%"), "WC SVR", Node_ID), Node_ID=if(like(issue, "EU SVR%"), "EU SVR", Node_ID), Node_ID=if(like(issue, "SE SVR%"), "SE SVR", Node_ID), Node_ID=if(like(issue, "NE SVR%"), "NE SVR", Node_ID)

This does what I want and adds those values to the field Node_ID but when I try to search by one of them:

| search Node_ID="WC SVR"

I get zero results even though I can see there are 4 events when looking at the field in the sidebar. Is there a reason behind this?

** Any suggestions to do this another way are always appreciated**

[ITWhisperer]

Looks like a bug - try like this:

| eval Node_ID=if(like(issue, "WC SVR%"), "WC SVR", Node_ID)
| eval Node_ID=if(like(issue, "EU SVR%"), "EU SVR", Node_ID)
| eval Node_ID=if(like(issue, "SE SVR%"), "SE SVR", Node_ID)
| eval Node_ID=if(like(issue, "NE SVR%"), "NE SVR", Node_ID)
| where Node_ID=="WC SVR"

or this

| eval Node_ID=case(like(issue, "WC SVR%"), "WC SVR", like(issue, "EU SVR%"), "EU SVR", like(issue, "SE SVR%"), "SE SVR", like(issue, "NE SVR%"), "NE SVR") 
| search Node_ID="WC SVR"