I am doing eval response = if ("msg.RESPONSE"="200", "Success", "Fail" ), and I have all msg.RESPONSE as 200 but still i get Fail in output. As per splunk docs, value after condition should be returned if condition is true but it's reverse in my case. The logs are in JSON format like below msg.RESPONSE : 200 ... View more

I am using a query as below | inputlookup lookup_name where (Environment=PROD) AND sourcetype="name" | join type=inner Environment, host [| savedsearch "name" | stats count as Total by Environment, App, host ] | fillnull value=NULL Total | search Total=NULL Lookup is having only 2 columns Environment & Host returning PROD & Server_name, the saved search returns approx 10000 rows. This alert runs every 15 minutes but many times gets triggered with NULL result even when the actual result is not NULL. Alert condition is that if Total=NULL comes up it will send email but 90% of them are false alarms. Is it because the saved search is taking time to output and splunk is having some threshold appending just NULL in case it exceeds. ... View more