topic Re: How to filter out those with empty JSON field in Splunk Search

How to filter out those with empty JSON field?

sanggonlee — Mon, 12 Dec 2022 14:58:04 GMT

My logs have a JSON field, like this:

{
  "foo": 5,
  "bar": {}
}

I'd like to filter out logs that have an empty JSON for the "bar" field, like in the above example.

How do I do that? I tried something like

where len('bar{}') > 0

but didn't work.

Thank you so much

richgalloway — Tue, 01 Nov 2022 14:38:36 GMT

Try this.

| where isnotnull("bar.*")

yuanliu — Sat, 10 Dec 2022 21:09:06 GMT

Note bar is not an array, therefore bar{} does not exist. In that sample data, bar is null. So, to exclude them,

| where isnotnull(bar)