Hi, I use Splunk 6.2. I try to compare two values between two differents weeks. index="market_logs" host="12.0.0.1" OR host="12.0.0.2" AND status="rejected" OR status="error" AND srcip="192.168.0.1" OR srcip="192.168.0.2" | eval r_before = [search index="market_logs" host="12.0.0.1" OR host="12.0.0.2" AND status="rejected" OR status="error" AND srcip="192.168.0.1" OR srcip="192.168.0.2" earliest=-14d@h latest=-7d@h | stats count] | stats count AS r_now But it doesn't work. I have the following error : "Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr])." I use a script who extract the two values. Can someone help me please ? Thanks, falcom92 ... View more