with the same search conditions, I cannot make eval if function to return true...

[leonjxtan]

For some use case, I need to make a new true/false field.

Below condition returns 11 events in my data sample:
| from datamodel:"SomeDataModel.SomeDataSet" |search LocalField1=ABC AND CalculatedField2!=0

But if I write it with Eval and if functions like below, it returns no event:
| from datamodel:"SomeDataModel.SomeDataSet" |eval truefalseField1=if((LocalField1=ABC AND CalculatedField2!=0),true,false)
|search truefalseField1=true

How can I make the 2nd search also return same (11) events? Could you please help?

Thanks.

[rjthibod]

The values true and false are not recognized values. You have to use either the strings values "true" and "false" or use numbers 1 and 0.

For example

| from datamodel:"SomeDataModel.SomeDataSet" |eval truefalseField1=if((LocalField1=ABC AND CalculatedField2!=0),1,0) | search truefalseField1=1

[leonjxtan]

found reason why. It is that only when in eval statement, the CalculatedField2 failed to return any value. but in the first statement, the calculated field worked fine.

[leonjxtan]

this is actually splunk-enterprise question, but after I click the Splunk Enterprise button and then click the “Post Your Question” button, it gives me error: The following topics are not present in the system, and you don't have permissions to create new ones: splunk-enterprise

[cmerriman]

have you tried putting everything in quotations that isn't a number?

| from datamodel:"SomeDataModel.SomeDataSet" |eval truefalseField1=if((LocalField1="ABC" AND CalculatedField2!=0),"true","false") 
|search truefalseField1="true"