topic how to fillnull json value pair using spath or some other command in Splunk Search

how to fillnull json value pair using spath or some other command

surekhasplunk — Wed, 31 Jul 2019 13:08:51 GMT

<notification-list xmlns="http://www......./restful/schema/response">
<added-instance preexisting="false">
<alarm id="12fffffa1">
<attribute id="0x10">abc</attribute>
<attribute id="0x11">machinename</attribute>
<attribute id="0x22"/>
/alarm>
</added-instance>

Above xml am storing as a json response in splunk and using spath to do further query.
But now the issue is if you see the last attribute the 0x22 doesn't have a value pair for the key and then the issue happens with orderly showing the table.

How to fill the value pair for that attribute with 0 value ?

Re: how to fillnull json value pair using spath or some other command

javiergn — Wed, 31 Jul 2019 14:15:06 GMT

Hi,

You could try with rex instead of spath. Something like this:

| makeresults | fields - _time
| eval myXML = "<notification-list xmlns=\"http://www......./restful/schema/response\">
 <added-instance preexisting=\"false\">
 <alarm id=\"12fffffa1\">
 <attribute id=\"0x10\">abc</attribute>
 <attribute id=\"0x11\">machinename</attribute>
 <attribute id=\"0x22\"/>
 </alarm>
 </added-instance>"
| rex field=myXML max_match=0 "(?msi)(?<attribute_line>\<attribute id\=.+?$)"
| mvexpand attribute_line
| rex field=attribute_line "id=\"(?<id>[^\"]+)\"(\/)?\>(?<attribute>[^\<]+)?"
| fillnull value=NULL attribute

Will produce something like the attached screenshot.

Hope that helps.

Regards,
J

Re: how to fillnull json value pair using spath or some other command

javiergn — Thu, 08 Aug 2019 11:08:43 GMT

Hi @surekhasplunk, did this solve your problem? If so, please do not forget to accept the answer so that we can close the question and others can benefit from it.

Thanks, J