Splunk Search

How to evaluate if a field is null or not null from JSON structured data?

brajaram
Communicator

My data is structured into a JSON with a field inside a block that is as follows

{  "SomeField":"Value",
   "serviceInfoBlock":{"SomeOtherField":"Value",
                       "logID":"Value"}
 }

The LogID can be either null or have an actual value populated in it. I am trying to use eval to create a new field "isNull" that can tell me if the logID is null, or has a value in it.

If I do |eval isNull=if(serviceInfoBlock.logID==null, "True", "False") it creates the field but assigns every value to be false.
If I do |eval isNull=if(isnull(serviceInfoBlock.logID), "True", "False") it creates the field but assigns every value to be true.

If in my intial search, however, I add in serviceInfoBlock.logID=null or serviceInfoBlock.logID!=null it properly filters my results.

Why can I filter properly in the search, but not create a field of the same type of filtering through eval?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

The field names which contains non-alphanumeric characters (dot, dash etc), needs to be enclosed in single quotes, in the right side of the expression for eval and where command. So, following should work.

|eval isNull=if('serviceInfoBlock.logID'==null(), "True", "False")
|eval isNull=if(isnull('serviceInfoBlock.logID'), "True", "False")

In the base search OR with |search command, you don't need the field name to be enclosed within single quotes, hence it works.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

The field names which contains non-alphanumeric characters (dot, dash etc), needs to be enclosed in single quotes, in the right side of the expression for eval and where command. So, following should work.

|eval isNull=if('serviceInfoBlock.logID'==null(), "True", "False")
|eval isNull=if(isnull('serviceInfoBlock.logID'), "True", "False")

In the base search OR with |search command, you don't need the field name to be enclosed within single quotes, hence it works.

brajaram
Communicator

Thanks! I had tried variations with quotation marks, didn't realize I needed single quotes to make it work.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...