topic Re: Search result evaluates to true when it is false in Splunk Search

Search result evaluates to true when it is false

shaunm001 — Tue, 28 Jan 2025 17:20:07 GMT

Hello, trying to figure out why this eval statement testing for a null value always evaluates to "true", even when the field does contain data:

Here is what the data looks like in the results:

Re: Search result evaluates to true when it is false

alex_tc80 — Tue, 28 Jan 2025 18:30:06 GMT

Hi, use spath : https://docs.splunk.com/Documentation/Splunk/9.4.0/SearchReference/Spath

To see why it happens, add and eval with just | eval subject2=Item.Subject ... | table ..., subject2
(subject2 be null)

I have a splunk index in JSON that has the key SRV and key CONTENT_LENGTH.
If i do

index=someindex 
| eval CONTENT_TYPE=if(isnull(SRV.CONTENT_TYPE),"true","false") 
| table SRV.CONTENT_TYPE, CONTENT_TYPE

I will get the same problem as you do.

But like below, i dont :

index=someindex 
| spath output=qwe "SRV.CONTENT_TYPE" 
| eval CONTENT_TYPE=if(isnull(qwe),"true","false") 
| table SRV.CONTENT_TYPE, CONTENT_TYPE

Re: Search result evaluates to true when it is false

shaunm001 — Tue, 28 Jan 2025 18:45:58 GMT

Ahh..thanks, this was killing me. I was also having trouble with the eval statement checking an array value (kept erroring out), but seems like spath was the key there as well.

This ended up working for me:

index=someindex | spath output=sentSubject "Item.Subject" | spath output=receivedSubject "AffectedItems{}.Subject" | eval subject = if(isnull(sentSubject),receivedSubject,sentSubject) | table UserId,subject,Operation, _time

Re: Search result evaluates to true when it is false

PickleRick — Wed, 29 Jan 2025 10:22:37 GMT

You are doing

isnull(Item.Subject)

Since you are not enclosing the Item.Subject part in quotes (in this case - you should use single quotes) Splunk treats Item and Subject as separate field names and tries to concatenate (the dot operator) their values. Since you have no fields called neither Item nor Subject in your data, the result of joining two null values is of course null as well.

You should do

isnull('Item.Subject')

to get a correct result.

Spath is not needed and since Splunk has already done automatic json extraction, it's a needless performance hit.

Re: Search result evaluates to true when it is false

shaunm001 — Wed, 29 Jan 2025 16:11:40 GMT

Great, this also works and is actually simpler than the spath solution, thanks!