I have some data which is changing from a delimited format to JSON. In a dashboard, I have a query that for the old format would do this:
sourcetype=oldformat | eval blocked = if(fieldname=="BLOCKED",1,0)
However, trying this against the JSON it doesn't work right.
sourcetype=newformat | eval blocked =if (a.b.fieldname=="BLOCKED", 1,0)
But this doesn't seem to work ... all records evaluate to 0. I test this out, I ran the following, which was just bizarre:
sourcetype=newformat a.b.fieldname="BLOCKED" | eval blocked =if (a.b.fieldname=="BLOCKED", 1,0) | chart count by a.b.fieldname, blocked
The result table looked like this:
So it was able to search by the field name (it found only the correct records out of millions) and it shows the correct value (BLOCKED) ... but the if statement that works fine when not looking at JSON seems to be broken with the JSON.