How to query two nullable nested fields are not equal? [newbie question]

roliu — Fri, 04 Nov 2022 00:46:04 GMT

Hi,

I have a dataset like below

[ {classificationA: null, classificationB: null}, {classificationA: {name: 'Education'}, classificationB: {name: 'Education'}}, {classificationA: {name: 'IT'}, classificationB: {name: 'IT'}} }

My aim is to find all the rows whose classificationA is not equals to classificationB. So given the above dataset, it should return zero rows.

I thought it should be:

| where classficationA != classficationB

But it is not working. Anyone can help? Thank you!

Re: How to query two nullable nested fields are not equal? [newbie question]

bowesmana — Fri, 04 Nov 2022 03:02:50 GMT

Is that your 'raw' data - it is not valid JSON. Is that a single event or 3 events?

Please share the raw data - if it's 3 classifications inside a single event, then please paste an example of the true _raw element of the value of a field that's extracted

topic How to query two nullable nested fields are not equal? [newbie question] in Splunk Search

How to query two nullable nested fields are not equal? [newbie question]

Re: How to query two nullable nested fields are not equal? [newbie question]