How can I query and find records which have an empty array?

[dreddy123]

My JSON looks like this,

{
"id":"studentNumber",
"courses" : [ {
"course" : "Analysis of Alg"
},
{
"course": "game dev"
}

]

}

I would like to get all the student numbers who haven't registered for any courses --> where "courses" array is empty.

[kamlesh_vaghela]

@ dreddy123

Can you please try this?

YOUR_SEARCH  | rename courses{}.course as courses_course | where isnull(courses_course) 

My Sample Search:

| makeresults | eval _raw="{\"id\":\"studentNumber\",\"courses\":[{\"course\" : \"Analysis of Alg\"},{\"course\": \"game dev\"}]}" | append [ | makeresults | eval _raw="{\"id\":\"studentNumber\",\"courses\":[]}" ] |kv | rename courses{}.course as courses_course | where isnull(courses_course)

Thanks

[nrduren1115]

Does courses show up as a field in those events? If not, you can use | where isnull(courses)

[dreddy123]

{
"id":"studentNumber",
"courses" : [ ]
}
it will show up like this when no courses are registered.

[nrduren1115]

To be a bit more specific, is courses extracted as a field and if so, what is the value?