topic Can spath cater for missing values in an array? in Splunk Search

Can spath cater for missing values in an array?

ewanbrown — Fri, 16 Mar 2018 16:19:05 GMT

Hi,

I have a nested array and I want to compare values across

I've a query that works, apart from when a value is missing (the whole JSON is not present rather than it is empty)

The query snippet is ... | spath output=my_one path=bean.test{}.one | spath output=my_two path=bean.test{}.two ...

In the example with this data below I want my_two to have two values, 45 and null, not one value of 45

    {test}
    {
          one: 23
          two: 45
         three: 12
    }
    {
          one: 34
          three: 67
   }

Can I use spath for this, or is there another way?

Thanks

Re: Can spath cater for missing values in an array?

DalJeanis — Mon, 12 Nov 2018 05:07:37 GMT

Multivalue fields in Splunk do not contain elements with null values, so there would never be an output field that had a "null" in a multivalue slot.

Thus, if you want to compare to the two items, you are going to have to extract them individually as a workaround.

  | spath output=my_one0 path=bean.test{0}.one 
  | spath output=my_one1 path=bean.test{1}.one 
  | spath output=my_two0 path=bean.test{0}.two 
  | spath output=my_two1 path=bean.test{1}.two