Splunk Search

How to evaluate if a field is null or not null from JSON structured data?

brajaram
Communicator

My data is structured into a JSON with a field inside a block that is as follows

{  "SomeField":"Value",
   "serviceInfoBlock":{"SomeOtherField":"Value",
                       "logID":"Value"}
 }

The LogID can be either null or have an actual value populated in it. I am trying to use eval to create a new field "isNull" that can tell me if the logID is null, or has a value in it.

If I do |eval isNull=if(serviceInfoBlock.logID==null, "True", "False") it creates the field but assigns every value to be false.
If I do |eval isNull=if(isnull(serviceInfoBlock.logID), "True", "False") it creates the field but assigns every value to be true.

If in my intial search, however, I add in serviceInfoBlock.logID=null or serviceInfoBlock.logID!=null it properly filters my results.

Why can I filter properly in the search, but not create a field of the same type of filtering through eval?

0 Karma
1 Solution

somesoni2
Revered Legend

The field names which contains non-alphanumeric characters (dot, dash etc), needs to be enclosed in single quotes, in the right side of the expression for eval and where command. So, following should work.

|eval isNull=if('serviceInfoBlock.logID'==null(), "True", "False")
|eval isNull=if(isnull('serviceInfoBlock.logID'), "True", "False")

In the base search OR with |search command, you don't need the field name to be enclosed within single quotes, hence it works.

View solution in original post

somesoni2
Revered Legend

The field names which contains non-alphanumeric characters (dot, dash etc), needs to be enclosed in single quotes, in the right side of the expression for eval and where command. So, following should work.

|eval isNull=if('serviceInfoBlock.logID'==null(), "True", "False")
|eval isNull=if(isnull('serviceInfoBlock.logID'), "True", "False")

In the base search OR with |search command, you don't need the field name to be enclosed within single quotes, hence it works.

brajaram
Communicator

Thanks! I had tried variations with quotation marks, didn't realize I needed single quotes to make it work.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...