Splunk Search

How to use JSON subfields with the eval command?

gzak
Engager

My log entries consist of a single json object, like so:

{ Severity: "INFO", Message: { StatusCode: 200, Route: "/hello/world?x=1" } }
{ Severity: "WARN", Message: { StatusCode: 500, Route: "/hello/world?x=2" } }

Just as a test, I'm able to create the following panel in my dashboard:

index="my_index" | bucket span=10m _time | stats count(eval(Severity="WARN")) as warning by Message.Route, _time

This appears to work fine since the Severity property is at the root of the json object. However, if I switch to one of the subproperties of the object, it doesn't find any records:

index="my_index" | bucket span=10m _time | stats count(eval(Message.StatusCode="500")) as warning by Message.Route, _time

I should also point out that if I don't wrap the "500" in quotes, it gives me a typechecking error saying that the '==' operator is being applied to two different types of arguments (which doesn't make any sense, and might be contributing to this issue).

Please advise on how I can procede. This shouldn't be so difficult...

1 Solution

somesoni2
Revered Legend

Field names which contains special characters like spaces OR dot (.), should be enclosed within single quotes when referring in eval OR where command's expressions. So your second query should work with following syntax

 index="my_index" | bucket span=10m _time | stats count(eval('Message.StatusCode'="500")) as warning by Message.Route, _time

View solution in original post

somesoni2
Revered Legend

Field names which contains special characters like spaces OR dot (.), should be enclosed within single quotes when referring in eval OR where command's expressions. So your second query should work with following syntax

 index="my_index" | bucket span=10m _time | stats count(eval('Message.StatusCode'="500")) as warning by Message.Route, _time

gzak
Engager

I could have sworn I tried all sorts of combinations of single quotes yesterday before coming here, but today it worked on my first try. Anwyay, this is definitely the solution.

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...