Getting Data In

How to exclude field with null value?

vin02ptl
Explorer

I have indexed a JSON file and want to remove field which has 'null' value(event 1) but if the same field have any correct value in the next event(2) it should consider that field and extract the result. Please advise.
Logs as below:

Event1:

{
   policy: null
   protocol: null
   reason: null
   severity: low
   sid: xxx
   source_port: null
   src: xx.xx.xx.xx
   success: null
   terminal_source: xx.xx.xx.xx

 }

Event2:

{
   policy: Normal
   protocol: 4
   reason: null
   severity: low
   sid: xxx
   source_port: 234
   src: xx.xx.xx.xx
   success: null
   terminal_source: xx.xx.xx.xx

 }
Labels (1)

damode1
Path Finder

Were you able to fix this ?

0 Karma

vin02ptl
Explorer

I am looking for search time extraction for cim compliance and using kv_mode = json. In that case how to proceed?

0 Karma

woodcock
Esteemed Legend

If you are using INDEXED_EXTRACTIONS = json then you can use INGEST_EVAL like this

[YourSourcetypeHere]
INGEST_EVAL-policy   = nullif(policy,   "null")
INGEST_EVAL-protocol = nullif(protocol, "null")
INGEST_EVAL-reason   = nullif(reason,   "null")
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...