Getting Data In
Highlighted

Why is Splunk converting zero values to null values in JSON data and how to fix this?

Path Finder

I have some JSON data I am sending to Splunk. E.g.

{ "Quality": {
                "Errors Reported": 3,
                "Errors Waived": 0,
                "Warnings Reported": 0,
                "Warnings Waived": 0
}}

The values are integer. Non zero ones show up fine in Splunk. But the ones that are 0, Splunk shows them as null.
That is incorrect behavior, because 0 is not null. I might actually have some other keys in the JSON as null and they are not 0.

How do I rectify this?

Tags (4)
Highlighted

Re: Why is Splunk converting zero values to null values in JSON data and how to fix this?

SplunkTrust
SplunkTrust

I've just indexed your example and the values come out as zero rather than null. What version are you on?

I'd upload a screenshot, but Splunk Answers thinks I need more karma to do that...

alt text
...hosting elsewhere seems to work though. Adding a null field to that sum will make the entire sum be null, so I'm certain those four fields do not contain any nulls.

Highlighted

Re: Why is Splunk converting zero values to null values in JSON data and how to fix this?

Path Finder

I am on 6.1, What about you?

For me, when I search in Splunk and the event comes back, it looks like this:
{ "Quality": {
"Errors Reported": 3,
"Errors Waived": null,
"Warnings Reported": null,
"Warnings Waived": null
}}

0 Karma
Highlighted

Re: Why is Splunk converting zero values to null values in JSON data and how to fix this?

SplunkTrust
SplunkTrust

6.1.3... playing around a bit more it seems to me as if the JSONTree syntax highlighter may be broken. When you view the raw event it shows 0, when you do maths it uses 0, but when you show the syntax highlighted tree it shows null.

View solution in original post

Highlighted

Re: Why is Splunk converting zero values to null values in JSON data and how to fix this?

Path Finder

Indeed! The highlighter wrongly shows null, but when I do any math, or even simply tabulate the data (using fields and table commands), things are all good.

Thanks Martin for spending time on investigating this and providing an answer.

How can I mark Martin's last comment as an answer?

Highlighted

Re: Why is Splunk converting zero values to null values in JSON data and how to fix this?

SplunkTrust
SplunkTrust

You can't convert comments to answers yet, needs more karma.

0 Karma
Highlighted

Re: Why is Splunk converting zero values to null values in JSON data and how to fix this?

SplunkTrust
SplunkTrust

Remember to submit a ticket with Splunk Support to eventually get this fixed some day.

0 Karma
Highlighted

Re: Why is Splunk converting zero values to null values in JSON data and how to fix this?

Path Finder

Done. Case number 196886

0 Karma
Highlighted

Re: Why is Splunk converting zero values to null values in JSON data and how to fix this?

Path Finder

Was this issue resolved in 6.2?

0 Karma
Highlighted

Re: Why is Splunk converting zero values to null values in JSON data and how to fix this?

Splunk Employee
Splunk Employee

This is a known issue (SPL-93801) which is fixed in 6.1.6 and in 6.2.0

0 Karma