Getting Data In

In a dashboard query, how do you use a JSON field in an if statement?

ShagVT
Path Finder

I have some data which is changing from a delimited format to JSON. In a dashboard, I have a query that for the old format would do this:

sourcetype=oldformat | eval blocked = if(fieldname=="BLOCKED",1,0)
However, trying this against the JSON it doesn't work right.

sourcetype=newformat | eval blocked =if (a.b.fieldname=="BLOCKED", 1,0)
But this doesn't seem to work ... all records evaluate to 0. I test this out, I ran the following, which was just bizarre:

sourcetype=newformat a.b.fieldname="BLOCKED" | eval blocked =if (a.b.fieldname=="BLOCKED", 1,0) | chart count by a.b.fieldname, blocked
The result table looked like this:


a.b.fieldname 0
BLOCKED 45

So it was able to search by the field name (it found only the correct records out of millions) and it shows the correct value (BLOCKED) ... but the if statement that works fine when not looking at JSON seems to be broken with the JSON.

Any ideas?

Tags (2)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@ShagVT ,

Add ' to the fieldname to make it as literal and then do the comparison.

Try

sourcetype=newformat | eval blocked =if ('a.b.fieldname'=="BLOCKED", 1,0)

Or
Rename the field and compare

sourcetype=newformat|rename a.b.fieldname as fieldname |eval blocked =if (fieldname =="BLOCKED", 1,0)
Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

@ShagVT ,

Add ' to the fieldname to make it as literal and then do the comparison.

Try

sourcetype=newformat | eval blocked =if ('a.b.fieldname'=="BLOCKED", 1,0)

Or
Rename the field and compare

sourcetype=newformat|rename a.b.fieldname as fieldname |eval blocked =if (fieldname =="BLOCKED", 1,0)
Happy Splunking!

ShagVT
Path Finder

Both of these ideas were successful. THANK YOU!

So is this basically a bug in Splunk's evaluation of conditional functions?

0 Karma

prakash007
Builder

did you see a.b.fieldname as a interesting field in your JSON data..??
can you post a sample of you json data..??

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...