Splunk Search

How to evaluate if a field is null or not null from JSON structured data?

brajaram
Communicator

My data is structured into a JSON with a field inside a block that is as follows

{  "SomeField":"Value",
   "serviceInfoBlock":{"SomeOtherField":"Value",
                       "logID":"Value"}
 }

The LogID can be either null or have an actual value populated in it. I am trying to use eval to create a new field "isNull" that can tell me if the logID is null, or has a value in it.

If I do |eval isNull=if(serviceInfoBlock.logID==null, "True", "False") it creates the field but assigns every value to be false.
If I do |eval isNull=if(isnull(serviceInfoBlock.logID), "True", "False") it creates the field but assigns every value to be true.

If in my intial search, however, I add in serviceInfoBlock.logID=null or serviceInfoBlock.logID!=null it properly filters my results.

Why can I filter properly in the search, but not create a field of the same type of filtering through eval?

0 Karma
1 Solution

somesoni2
Revered Legend

The field names which contains non-alphanumeric characters (dot, dash etc), needs to be enclosed in single quotes, in the right side of the expression for eval and where command. So, following should work.

|eval isNull=if('serviceInfoBlock.logID'==null(), "True", "False")
|eval isNull=if(isnull('serviceInfoBlock.logID'), "True", "False")

In the base search OR with |search command, you don't need the field name to be enclosed within single quotes, hence it works.

View solution in original post

somesoni2
Revered Legend

The field names which contains non-alphanumeric characters (dot, dash etc), needs to be enclosed in single quotes, in the right side of the expression for eval and where command. So, following should work.

|eval isNull=if('serviceInfoBlock.logID'==null(), "True", "False")
|eval isNull=if(isnull('serviceInfoBlock.logID'), "True", "False")

In the base search OR with |search command, you don't need the field name to be enclosed within single quotes, hence it works.

brajaram
Communicator

Thanks! I had tried variations with quotation marks, didn't realize I needed single quotes to make it work.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...