topic Re: null events while using spath in Splunk Search

null events while using spath

sasamudr — Wed, 20 Sep 2017 07:20:02 GMT

JSON:

"mainArray":
[
{"name":"MS","value":20},
{"name":"MC","value":20},
{"name":"CF","value":20},
{"name":"ST"},
{"name":"CMR","value":20}
]

-- i am currently using the search as " | spath output=code path=mainArray{}.name | spath output=cnt path=mainArray{}.value | table code,cnt"

and the output i see is as :

code cnt
MS 20
MC 20
CF 20
ST 20
CMR

The Expected Output is:

code cnt
MS 20
MC 20
CF 20
ST

CMR 20

Re: null events while using spath

somesoni2 — Wed, 20 Sep 2017 17:04:39 GMT

Try like this (runanywhere sample. Everything before | rex command is for generating sample data, replace that with your base search.

| gentimes start=-1 | eval _raw="{\"mainArray\":
[
 {\"name\":\"MS\",\"value\":20},
 {\"name\":\"MC\",\"value\":20},
 {\"name\":\"CF\",\"value\":20},
 {\"name\":\"ST\"},
 {\"name\":\"CMR\",\"value\":20}
]}" | table _raw 
| rex mode=sed "s/(\"name\":\"[^\"]+\")\}/\1,\"value\":\"NA\"}/g" | spath  | spath output=code path=mainArray{}.name | spath output=cnt path=mainArray{}.value | table code,cnt

Re: null events while using spath

sasamudr — Wed, 20 Sep 2017 18:16:48 GMT

Thanks a lot @ somesoni2. i was able to use your regex with sed to make the null event as NA and it worked perfectly.