Splunk Search

How to evaluate if a field is null or not null from JSON structured data?

brajaram
Communicator

My data is structured into a JSON with a field inside a block that is as follows

{  "SomeField":"Value",
   "serviceInfoBlock":{"SomeOtherField":"Value",
                       "logID":"Value"}
 }

The LogID can be either null or have an actual value populated in it. I am trying to use eval to create a new field "isNull" that can tell me if the logID is null, or has a value in it.

If I do |eval isNull=if(serviceInfoBlock.logID==null, "True", "False") it creates the field but assigns every value to be false.
If I do |eval isNull=if(isnull(serviceInfoBlock.logID), "True", "False") it creates the field but assigns every value to be true.

If in my intial search, however, I add in serviceInfoBlock.logID=null or serviceInfoBlock.logID!=null it properly filters my results.

Why can I filter properly in the search, but not create a field of the same type of filtering through eval?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

The field names which contains non-alphanumeric characters (dot, dash etc), needs to be enclosed in single quotes, in the right side of the expression for eval and where command. So, following should work.

|eval isNull=if('serviceInfoBlock.logID'==null(), "True", "False")
|eval isNull=if(isnull('serviceInfoBlock.logID'), "True", "False")

In the base search OR with |search command, you don't need the field name to be enclosed within single quotes, hence it works.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

The field names which contains non-alphanumeric characters (dot, dash etc), needs to be enclosed in single quotes, in the right side of the expression for eval and where command. So, following should work.

|eval isNull=if('serviceInfoBlock.logID'==null(), "True", "False")
|eval isNull=if(isnull('serviceInfoBlock.logID'), "True", "False")

In the base search OR with |search command, you don't need the field name to be enclosed within single quotes, hence it works.

brajaram
Communicator

Thanks! I had tried variations with quotation marks, didn't realize I needed single quotes to make it work.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...