Indexing Json Array field

[galsegal]

Hey, 

Can you please assist me with how to index this field:

What I'm trying to do is to know which index has the 'true' value in it and take action accordingly.

For example , in pseudo code:

if(message.anomaly.features{}.anomaly[0] == true 
then newfield = 0

Thanks!

[niketn · Accepted solution]

@galsegal Try adding the following condition to find whether true value is present within JSON field message.anomaly.features.anomaly{} 

| eval isTrue=if(('message.anomaly.features.anomaly{}'="true"),1,0)

The field isTrue evaluates to 1 if there is true value identified in respective field. If not it evaluates to 0.

PS: If you want to filter only events with one of the values as true instead of eval you can directly use search i.e. 

| search "message.anomaly.features.anomaly{}"="true"

Following is a run anywhere example based on one of the sample data provided.

| makeresults 
| eval _raw="
{
   \"message\":{
      \"anomaly\":{
         \"features\":{
            \"anomaly\":[
               \"false\",
               \"true\",
               \"false\",
               \"false\"
                ]
         }
      }
   }
}" 
| append 
    [| makeresults 
    | eval _raw="
{
   \"message\":{
      \"anomaly\":{
         \"features\":{
            \"anomaly\":[
               \"false\",
               \"false\",
               \"false\",
               \"false\"
                    ]
         }
      }
   }
}"] 
| spath 
| fields - _raw _time 
| eval isTrue=if(('message.anomaly.features.anomaly{}'="true"),1,0)

 Please try out and confirm!

[galsegal]

Hi niketnilay,

Thanks for stepping in, appreciate the prompt response.

I might have phrased my question not so clear, what I’m trying to do is Ivactually need to know which of the indexes has the 'true' value in this. 

The best solution for me will be some kind of way to iterate this structure like in programming-

message.anomaly.features.anomaly{}[0],message.anomaly.features.anomaly{}[1] and so on..

Is this something that is possible to accomplish using splunk?

Thanks again,