Getting Data In

In a dashboard query, how do you use a JSON field in an if statement?

Path Finder

I have some data which is changing from a delimited format to JSON. In a dashboard, I have a query that for the old format would do this:

sourcetype=oldformat | eval blocked = if(fieldname=="BLOCKED",1,0)
However, trying this against the JSON it doesn't work right.

sourcetype=newformat | eval blocked =if (a.b.fieldname=="BLOCKED", 1,0)
But this doesn't seem to work ... all records evaluate to 0. I test this out, I ran the following, which was just bizarre:

sourcetype=newformat a.b.fieldname="BLOCKED" | eval blocked =if (a.b.fieldname=="BLOCKED", 1,0) | chart count by a.b.fieldname, blocked
The result table looked like this:


a.b.fieldname 0
BLOCKED 45

So it was able to search by the field name (it found only the correct records out of millions) and it shows the correct value (BLOCKED) ... but the if statement that works fine when not looking at JSON seems to be broken with the JSON.

Any ideas?

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

@ShagVT ,

Add ' to the fieldname to make it as literal and then do the comparison.

Try

sourcetype=newformat | eval blocked =if ('a.b.fieldname'=="BLOCKED", 1,0)

Or
Rename the field and compare

sourcetype=newformat|rename a.b.fieldname as fieldname |eval blocked =if (fieldname =="BLOCKED", 1,0)

View solution in original post

SplunkTrust
SplunkTrust

@ShagVT ,

Add ' to the fieldname to make it as literal and then do the comparison.

Try

sourcetype=newformat | eval blocked =if ('a.b.fieldname'=="BLOCKED", 1,0)

Or
Rename the field and compare

sourcetype=newformat|rename a.b.fieldname as fieldname |eval blocked =if (fieldname =="BLOCKED", 1,0)

View solution in original post

Path Finder

Both of these ideas were successful. THANK YOU!

So is this basically a bug in Splunk's evaluation of conditional functions?

0 Karma

Builder

did you see a.b.fieldname as a interesting field in your JSON data..??
can you post a sample of you json data..??

0 Karma