Getting Data In

How to exclude field with null value?

vin02ptl
Explorer

I have indexed a JSON file and want to remove field which has 'null' value(event 1) but if the same field have any correct value in the next event(2) it should consider that field and extract the result. Please advise.
Logs as below:

Event1:

{
   policy: null
   protocol: null
   reason: null
   severity: low
   sid: xxx
   source_port: null
   src: xx.xx.xx.xx
   success: null
   terminal_source: xx.xx.xx.xx

 }

Event2:

{
   policy: Normal
   protocol: 4
   reason: null
   severity: low
   sid: xxx
   source_port: 234
   src: xx.xx.xx.xx
   success: null
   terminal_source: xx.xx.xx.xx

 }
Labels (1)

damode1
Path Finder

Were you able to fix this ?

0 Karma

vin02ptl
Explorer

I am looking for search time extraction for cim compliance and using kv_mode = json. In that case how to proceed?

0 Karma

woodcock
Esteemed Legend

If you are using INDEXED_EXTRACTIONS = json then you can use INGEST_EVAL like this

[YourSourcetypeHere]
INGEST_EVAL-policy   = nullif(policy,   "null")
INGEST_EVAL-protocol = nullif(protocol, "null")
INGEST_EVAL-reason   = nullif(reason,   "null")
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...