Extracting a JSON boolean value

[danl]

I've been unable to get a boolean value extracted from JSON written to Splunk. The data looks like this:

   build: {
     build_id: bubyut7oi7xlg
     cache: {
       remote_enabled: false
     }
  }

Here's my search:

index=gradle_enterprise_export sourcetype="gradle-export-app" message=build_saved env="prod" build.build_id="bubyut7oi7xlg"
| spath
| rename build.cache.remote_enabled as remote
| eval remote_cache = if(remote=="false", "false", "true")
| table build.build_id remote_cache

I've tried a number of different combinations for remote=="false" using no quotes, single quotes, different cases. I've also tried directly using build.cache.remote_enabled == "false". (though another another post says eval will concatenate fields. Even quoted, it makes no difference).  The result should be "false" and  is always "true":

build.build_id     remote_cache
bubyut7oi7xlg   true

I've also used tostring() to show the remote_enabled value and it shows NULL.

Any ideas? Are JSON boolean values supported?

[to4kawa]

index=_internal | head 1 | fields _raw
| eval _raw="{\"build\":{\"build_id\":\"bubyut7oi7xlg\",\"cache\":{\"remote_enabled\":false}}}"
| spath
| eval check = if('build.cache.remote_enabled'="false","boolean","string")
| table *

build.build_id	build.cache.remote_enabled	check	_raw
bubyut7oi7xlg	false	boolean	{"build":{"build_id":"bubyut7oi7xlg","cache":{"remote_enabled":false}}}

my splunk is ver 8.0.3. there is no problem.

[danl]

thanks to4kawa. I tried your code, altering slightly for my search:

index=gradle_enterprise_export sourcetype="gradle-export-app" message=build_saved env="prod" build.build_id="bubyut7oi7xlg"
| spath
| eval check = if('build.cache.remote_enabled'="false", "boolean", "string")
| table check

I get "string" for the value of check. I'm running Splunk V7.2.7.3 and this is the raw text of the search result:

{
"build": {
"build_id": "bubyut7oi7xlg",
"cache": {
"remote_enabled": false
}
}
}

[thambisetty]

worth watching below video if you are beginner in regular expressions.

Regular expressions in Splunk 

Can share _raw to give you correct regex?

formatted json may have special characters which will not appear here.

[to4kawa]

wow, that's interesting.

workaround:

index=gradle_enterprise_export sourcetype="gradle-export-app" message=build_saved env="prod" build.build_id="bubyut7oi7xlg"
| rex mode=sed "s/false/\"false\"/g s/true/\"true\"/g"
| spath

[danl · Accepted solution]

I noticed when I tried your code - creating _raw, this worked. Note I fixed the "==" :

| eval _raw="{\"build\":{\"build_id\":\"bubyut7oi7xlg\",\"cache\":{\"remote_enabled\":false}}}"
| spath
| eval check = if('build.cache.remote_enabled'=="false", "boolean", "string")
| table check

However when I use the _raw value (which is much larger than my small subset, it fails).  I knew the _raw text was large, but I checked and I was surprised to see it was  > 5K characters. I did try using spath with an input path to try and give it a more precise starting point, but I guess it doesn't work that way. So I'm sure that is why mine was failing.  Your initial suggestion works fine by testing with quoted "false"!

To work around my problem,  I use this to extract the (fortunately unique) named value:

index=gradle_enterprise_export sourcetype="gradle-export-app" message=build_saved env="prod" build.build_id="bubyut7oi7xlg"
| rex field=_raw "\"remote_enabled\":(?P<remote_enabled>[^,]*)"
| table remote_enabled

Thanks for your suggestions. It helped!