topic Re: query to check is a list is [] or has values in it in Splunk Search

query to check is a list is [] or has values in it

wajeeh911 — Thu, 11 Jul 2019 22:36:48 GMT

I'm having trouble querying the field attached in the image. I either want to know is its empty or has values in it. Does anyone know the proper syntax?

Re: query to check is a list is [] or has values in it

marycordova — Thu, 11 Jul 2019 22:54:11 GMT

can you just table the field and post the results so we can see what is there currently?

| table failureRadar

Re: query to check is a list is [] or has values in it

wajeeh911 — Fri, 12 Jul 2019 04:25:16 GMT

@marycordova I'm not looking to table the results, I'm trying to query results only when the list is empty.

Re: query to check is a list is [] or has values in it

niketn — Fri, 12 Jul 2019 04:45:23 GMT

@wajeeh911 what is your current query? Can you post sample JSON (raw) for the two scenarios?
Have you tried the following filter?

| where isnull(failureRadar)

Re: query to check is a list is [] or has values in it

marycordova — Fri, 12 Jul 2019 05:03:10 GMT

Right but a table will let me see what your data looks like so I can help you

Re: query to check is a list is [] or has values in it

kamlesh_vaghela — Fri, 12 Jul 2019 05:32:59 GMT

@wajeeh911

In this case I suggest you to take benefit of any child field of failureRadar. Like, in my below sample example I have took A as child field of failureRadar. After renaming this field we can use it with where isnull( ( As @niketnilay said) to get failureRadar empty events. Please check my below Sample Search.

Events used:

{ "other_keys":"HI", "failureRadar":[]}

{ "other_keys":"HI", "failureRadar":[{"A":"B"}]}

Sample Search:

| makeresults | eval _raw="{ \"other_keys\":\"HI\", \"failureRadar\":[]}" | append [ | makeresults | eval _raw="{ \"other_keys\":\"HI\", \"failureRadar\":[{\"A\":\"B\"}]}" ] | kv
|rename failureRadar{}.A as myFlag
| where isnull(myFlag)

Can you please try below search ?

YOUR_SEARCH  |rename failureRadar{}.A as myFlag
| where isnull(myFlag)

Note: A is my child field of failureRadar. replace it with your original fields.

Try and let us know if any challenges. Please share some sample events for us to further assistance.

Thanks