topic Re: How can I query and find records which have an empty array? in Getting Data In

How can I query and find records which have an empty array?

dreddy123 — Fri, 19 Oct 2018 15:45:21 GMT

My JSON looks like this,

{
"id":"studentNumber",
"courses" : [ {
"course" : "Analysis of Alg"
},
{
"course": "game dev"
}

]

}

I would like to get all the student numbers who haven't registered for any courses --> where "courses" array is empty.

Re: How can I query and find records which have an empty array?

nrduren1115 — Fri, 19 Oct 2018 17:56:04 GMT

Does courses show up as a field in those events? If not, you can use | where isnull(courses)

Re: How can I query and find records which have an empty array?

dreddy123 — Fri, 19 Oct 2018 18:48:41 GMT

{
"id":"studentNumber",
"courses" : [ ]
}
it will show up like this when no courses are registered.

Re: How can I query and find records which have an empty array?

nrduren1115 — Fri, 19 Oct 2018 18:53:15 GMT

To be a bit more specific, is courses extracted as a field and if so, what is the value?

Re: How can I query and find records which have an empty array?

kamlesh_vaghela — Sun, 21 Oct 2018 17:02:05 GMT

@ dreddy123

Can you please try this?

YOUR_SEARCH  | rename courses{}.course as courses_course | where isnull(courses_course)

My Sample Search:

| makeresults | eval _raw="{\"id\":\"studentNumber\",\"courses\":[{\"course\" : \"Analysis of Alg\"},{\"course\": \"game dev\"}]}" | append [ | makeresults | eval _raw="{\"id\":\"studentNumber\",\"courses\":[]}" ] |kv | rename courses{}.course as courses_course | where isnull(courses_course)

Thanks