Hi,
i'am trying to evaluate a tag value like this: eval X=if(tag="NY",_time,"1")
I have trying everything and stuck in the mud. Anybody?
Hi @steinroardahl,
Is "tag" a field name because eval will work only if it is a field and not a value in your events?
Hi, is this true all sow with eventtypes?
hey @steinroardahl
I tried below search and it is working perfectly fine:
| eval X=if(tag="NY",_time,"1")
If you are not getting results then try this first
index=your_index tag="NY"
If above search is returning events then your eval should return events else your eval will not return any events.
let me know if this helps you!
That syntax looks accurate. Can you share a couple of sample events and the expected results vs. the current results?
I tried this in my own environment and it worked perfectly. Remember that the if function is case-sensitive.
Is it possible that your search is not returning any fields with the "NY" tag?
Also: what @elliotproebstel said