In a dashboard query, how do you use a JSON field in an if statement?

[ShagVT]

I have some data which is changing from a delimited format to JSON. In a dashboard, I have a query that for the old format would do this:

sourcetype=oldformat | eval blocked = if(fieldname=="BLOCKED",1,0)
However, trying this against the JSON it doesn't work right.

sourcetype=newformat | eval blocked =if (a.b.fieldname=="BLOCKED", 1,0)
But this doesn't seem to work ... all records evaluate to 0. I test this out, I ran the following, which was just bizarre:

sourcetype=newformat a.b.fieldname="BLOCKED" | eval blocked =if (a.b.fieldname=="BLOCKED", 1,0) | chart count by a.b.fieldname, blocked
The result table looked like this:

a.b.fieldname        0

BLOCKED              45

So it was able to search by the field name (it found only the correct records out of millions) and it shows the correct value (BLOCKED) ... but the if statement that works fine when not looking at JSON seems to be broken with the JSON.

Any ideas?

[renjith_nair · Accepted solution]

@ShagVT ,

Add ' to the fieldname to make it as literal and then do the comparison.

Try

sourcetype=newformat | eval blocked =if ('a.b.fieldname'=="BLOCKED", 1,0)

Or
Rename the field and compare

sourcetype=newformat|rename a.b.fieldname as fieldname |eval blocked =if (fieldname =="BLOCKED", 1,0)

[ShagVT]

Both of these ideas were successful. THANK YOU!

So is this basically a bug in Splunk's evaluation of conditional functions?

[prakash007]

did you see a.b.fieldname as a interesting field in your JSON data..??
can you post a sample of you json data..??