Getting Data In

Why is Splunk converting zero values to null values in JSON data and how to fix this?

shikhanshu
Path Finder

I have some JSON data I am sending to Splunk. E.g.

{ "Quality": {
                "Errors Reported": 3,
                "Errors Waived": 0,
                "Warnings Reported": 0,
                "Warnings Waived": 0
}}

The values are integer. Non zero ones show up fine in Splunk. But the ones that are 0, Splunk shows them as null.
That is incorrect behavior, because 0 is not null. I might actually have some other keys in the JSON as null and they are not 0.

How do I rectify this?

Tags (4)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

6.1.3... playing around a bit more it seems to me as if the JSONTree syntax highlighter may be broken. When you view the raw event it shows 0, when you do maths it uses 0, but when you show the syntax highlighted tree it shows null.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

6.1.3... playing around a bit more it seems to me as if the JSONTree syntax highlighter may be broken. When you view the raw event it shows 0, when you do maths it uses 0, but when you show the syntax highlighted tree it shows null.

shikhanshu
Path Finder

Done. Case number 196886

0 Karma

j6white
Path Finder

Was this issue resolved in 6.2?

0 Karma

Wiggy
Splunk Employee
Splunk Employee

This is a known issue (SPL-93801) which is fixed in 6.1.6 and in 6.2.0

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Remember to submit a ticket with Splunk Support to eventually get this fixed some day.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can't convert comments to answers yet, needs more karma.

0 Karma

shikhanshu
Path Finder

Indeed! The highlighter wrongly shows null, but when I do any math, or even simply tabulate the data (using fields and table commands), things are all good.

Thanks Martin for spending time on investigating this and providing an answer.

How can I mark Martin's last comment as an answer?

shikhanshu
Path Finder

I am on 6.1, What about you?

For me, when I search in Splunk and the event comes back, it looks like this:
{ "Quality": {
"Errors Reported": 3,
"Errors Waived": null,
"Warnings Reported": null,
"Warnings Waived": null
}}

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I've just indexed your example and the values come out as zero rather than null. What version are you on?

I'd upload a screenshot, but Splunk Answers thinks I need more karma to do that...

alt text
...hosting elsewhere seems to work though. Adding a null field to that sum will make the entire sum be null, so I'm certain those four fields do not contain any nulls.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...