Search result evaluates to true when it is false

[shaunm001]

Hello, trying to figure out why this eval statement testing for a null value always evaluates to "true", even when the field does contain data:

Here is what the data looks like in the results:

[PickleRick]

You are doing

isnull(Item.Subject)

Since you are not enclosing the Item.Subject part in quotes (in this case - you should use single quotes) Splunk treats Item and Subject as separate field names and tries to concatenate (the dot operator) their values. Since you have no fields called neither Item nor Subject in your data, the result of joining two null values is of course null as well.

You should do

isnull('Item.Subject')

to get a correct result.

Spath is not needed and since Splunk has already done automatic json extraction, it's a needless performance hit.

[shaunm001]

Great, this also works and is actually simpler than the spath solution, thanks!

[alex_tc80 · Accepted solution]

Hi, use spath : https://docs.splunk.com/Documentation/Splunk/9.4.0/SearchReference/Spath

To see why it happens, add and eval with just | eval subject2=Item.Subject ... | table ..., subject2 
(subject2 be null)

I have a splunk index in JSON that has the key SRV and key CONTENT_LENGTH.
If i do

index=someindex 
| eval CONTENT_TYPE=if(isnull(SRV.CONTENT_TYPE),"true","false") 
| table SRV.CONTENT_TYPE, CONTENT_TYPE

I will get the same problem as you do.

But like below, i dont :

index=someindex 
| spath output=qwe "SRV.CONTENT_TYPE" 
| eval CONTENT_TYPE=if(isnull(qwe),"true","false") 
| table SRV.CONTENT_TYPE, CONTENT_TYPE

[shaunm001]

Ahh..thanks, this was killing me. I was also having trouble with the eval statement checking an array value (kept erroring out), but seems like spath was the key there as well. 

This ended up working for me:

index=someindex
| spath output=sentSubject "Item.Subject"
| spath output=receivedSubject "AffectedItems{}.Subject"
| eval subject = if(isnull(sentSubject),receivedSubject,sentSubject)
| table UserId,subject,Operation, _time