topic How to evaluate if a field is null or not null from JSON structured data? in Splunk Search

How to evaluate if a field is null or not null from JSON structured data?

brajaram — Fri, 02 Mar 2018 16:56:37 GMT

My data is structured into a JSON with a field inside a block that is as follows

{  "SomeField":"Value",
   "serviceInfoBlock":{"SomeOtherField":"Value",
                       "logID":"Value"}
 }

The LogID can be either null or have an actual value populated in it. I am trying to use eval to create a new field "isNull" that can tell me if the logID is null, or has a value in it.

If I do |eval isNull=if(serviceInfoBlock.logID==null, "True", "False") it creates the field but assigns every value to be false.
If I do |eval isNull=if(isnull(serviceInfoBlock.logID), "True", "False") it creates the field but assigns every value to be true.

If in my intial search, however, I add in serviceInfoBlock.logID=null or serviceInfoBlock.logID!=null it properly filters my results.

Why can I filter properly in the search, but not create a field of the same type of filtering through eval?

Re: How to evaluate if a field is null or not null from JSON structured data?

somesoni2 — Fri, 02 Mar 2018 19:26:42 GMT

The field names which contains non-alphanumeric characters (dot, dash etc), needs to be enclosed in single quotes, in the right side of the expression for eval and where command. So, following should work.

|eval isNull=if('serviceInfoBlock.logID'==null(), "True", "False")
|eval isNull=if(isnull('serviceInfoBlock.logID'), "True", "False")

In the base search OR with |search command, you don't need the field name to be enclosed within single quotes, hence it works.

Re: How to evaluate if a field is null or not null from JSON structured data?

brajaram — Fri, 02 Mar 2018 19:47:38 GMT

Thanks! I had tried variations with quotation marks, didn't realize I needed single quotes to make it work.