Why is my "eval field=if()" search returning TRUE or FALSE instead of a numeric value?

[andrei1bc]

Hi.

I am trying to search across multiple indexes. The field I am looking for is Value (and has only numbers). This value must not contain any decimals, and in case the sourcetype is sourcetype1, then the value must be recalculated as (Value-100)*-1.

My search:

index=*  sourcetype="sourcetype1" OR source=source2 | eval Value=if(sourcetype="sourcetype1", Value=round(((Value-100)*-1), 0), Value=round(Value, 0))

The result I get is either True or False for the Value field. What am I doing wrong?

Thank you in advance.

[richgalloway · Accepted solution]

Your if command is returning comparisons instead of values. Try

index= sourcetype="sourcetype1" OR source=source2 | eval Value=if(sourcetype="sourcetype1", round(((Value-100)-1), 0), round(Value, 0))

[javiergn]

I've just deleted my answer as @richgalloway already provided you with a valid one

[andrei1bc]

• forgot to mention that there is no event in any index that has the sourcetype=sourcetype1 and source=source2
• sourcetype=sourcetype1 events are stored in index1
• source=source2 events are stored in index2
• searching by value and applying the same type of condition returns me the same TRUE / FALSE results