Splunk Search

How to use eval on JSON data

janoonan
Explorer

I'm going to suggest this is a bug, and I believe I've a workaround. I wonder if I've missed something.

My JSON is of form attr=true or attr=false, and I want to put this into a graph. However, it's a little bit down, so it's global.container.attr

So, I have:
| strcat otherterm " " global.container.attr combinedterm | ... | stats count by combinedterm

Which works, and provides true or false, but I would prefer "attr" or "opposite" (for the opposite of attr).

| expr if(global.container.attr==true, "attr", "opposite") | strcat otherterm " " global.container.attr combinedterm | ... | stats count by combinedterm
would always equal 'opposite'.

What I found would work was to rename before hand..

| rename global.container.attr AS tmp | expr if(tmp==true, "attr", "opposite") | .... (and so on).

this might help someone else, and there may be a better way.

Tags (2)
0 Karma
1 Solution

fdi01
Motivator

do like this:

...| rename global.container.* AS  * | eval attr= if(attr==true, "attr", "opposite") |....

then you can use like this:

....| rename global.container.* AS  * | eval attr= if(attr==true, "attr", "opposite") | stats count by attr

View solution in original post

somesoni2
Revered Legend

Since, you field name contains special character, in EVAL statements, you need to enclose it within single quotes. This should work fine for you.

| expr if('global.container.attr'==true, "attr", "opposite") | strcat otherterm " " global.container.attr combinedterm | ... | stats count by combinedterm 
0 Karma

fdi01
Motivator

do like this:

...| rename global.container.* AS  * | eval attr= if(attr==true, "attr", "opposite") |....

then you can use like this:

....| rename global.container.* AS  * | eval attr= if(attr==true, "attr", "opposite") | stats count by attr
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...