https://community.splunk.com/t5/Splunk-Search/How-to-use-eval-on-JSON-data/m-p/194723#M56153 <P>do like this:</P> <PRE><CODE>...| rename global.container.* AS * | eval attr= if(attr==true, "attr", "opposite") |.... </CODE></PRE> <P>then you can use like this:</P> <PRE><CODE>....| rename global.container.* AS * | eval attr= if(attr==true, "attr", "opposite") | stats count by attr </CODE></PRE> Wed, 25 Mar 2015 17:10:17 GMT fdi01 2015-03-25T17:10:17Z https://community.splunk.com/t5/Splunk-Search/How-to-use-eval-on-JSON-data/m-p/194722#M56152 <P>I'm going to suggest this is a bug, and I believe I've a workaround. I wonder if I've missed something. </P> <P>My JSON is of form attr=true or attr=false, and I want to put this into a graph. However, it's a little bit down, so it's global.container.attr</P> <P>So, I have:<BR /> | strcat otherterm " " global.container.attr combinedterm | ... | stats count by combinedterm</P> <P>Which works, and provides true or false, but I would prefer "attr" or "opposite" (for the opposite of attr). </P> <P>| expr if(global.container.attr==true, "attr", "opposite") | strcat otherterm " " global.container.attr combinedterm | ... | stats count by combinedterm <BR /> would always equal 'opposite'. </P> <P>What I found would work was to rename before hand..</P> <P>| rename global.container.attr AS tmp | expr if(tmp==true, "attr", "opposite") | .... (and so on). </P> <P>this might help someone else, and there may be a better way.</P> Wed, 25 Mar 2015 15:26:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-eval-on-JSON-data/m-p/194722#M56152 janoonan 2015-03-25T15:26:39Z https://community.splunk.com/t5/Splunk-Search/How-to-use-eval-on-JSON-data/m-p/194723#M56153 <P>do like this:</P> <PRE><CODE>...| rename global.container.* AS * | eval attr= if(attr==true, "attr", "opposite") |.... </CODE></PRE> <P>then you can use like this:</P> <PRE><CODE>....| rename global.container.* AS * | eval attr= if(attr==true, "attr", "opposite") | stats count by attr </CODE></PRE> Wed, 25 Mar 2015 17:10:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-eval-on-JSON-data/m-p/194723#M56153 fdi01 2015-03-25T17:10:17Z https://community.splunk.com/t5/Splunk-Search/How-to-use-eval-on-JSON-data/m-p/194724#M56154 <P>Since, you field name contains special character, in EVAL statements, you need to enclose it within single quotes. This should work fine for you.</P> <PRE><CODE>| expr if('global.container.attr'==true, "attr", "opposite") | strcat otherterm " " global.container.attr combinedterm | ... | stats count by combinedterm </CODE></PRE> Wed, 25 Mar 2015 17:17:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-eval-on-JSON-data/m-p/194724#M56154 somesoni2 2015-03-25T17:17:41Z