Getting Data In

Why is Splunk converting zero values to null values in JSON data and how to fix this?

Path Finder

I have some JSON data I am sending to Splunk. E.g.

{ "Quality": {
                "Errors Reported": 3,
                "Errors Waived": 0,
                "Warnings Reported": 0,
                "Warnings Waived": 0
}}

The values are integer. Non zero ones show up fine in Splunk. But the ones that are 0, Splunk shows them as null.
That is incorrect behavior, because 0 is not null. I might actually have some other keys in the JSON as null and they are not 0.

How do I rectify this?

Tags (4)
1 Solution

SplunkTrust
SplunkTrust

6.1.3... playing around a bit more it seems to me as if the JSONTree syntax highlighter may be broken. When you view the raw event it shows 0, when you do maths it uses 0, but when you show the syntax highlighted tree it shows null.

View solution in original post

SplunkTrust
SplunkTrust

6.1.3... playing around a bit more it seems to me as if the JSONTree syntax highlighter may be broken. When you view the raw event it shows 0, when you do maths it uses 0, but when you show the syntax highlighted tree it shows null.

View solution in original post

Path Finder

Done. Case number 196886

0 Karma

Path Finder

Was this issue resolved in 6.2?

0 Karma

Splunk Employee
Splunk Employee

This is a known issue (SPL-93801) which is fixed in 6.1.6 and in 6.2.0

0 Karma

SplunkTrust
SplunkTrust

Remember to submit a ticket with Splunk Support to eventually get this fixed some day.

0 Karma

SplunkTrust
SplunkTrust

You can't convert comments to answers yet, needs more karma.

0 Karma

Path Finder

Indeed! The highlighter wrongly shows null, but when I do any math, or even simply tabulate the data (using fields and table commands), things are all good.

Thanks Martin for spending time on investigating this and providing an answer.

How can I mark Martin's last comment as an answer?

Path Finder

I am on 6.1, What about you?

For me, when I search in Splunk and the event comes back, it looks like this:
{ "Quality": {
"Errors Reported": 3,
"Errors Waived": null,
"Warnings Reported": null,
"Warnings Waived": null
}}

0 Karma

SplunkTrust
SplunkTrust

I've just indexed your example and the values come out as zero rather than null. What version are you on?

I'd upload a screenshot, but Splunk Answers thinks I need more karma to do that...

alt text
...hosting elsewhere seems to work though. Adding a null field to that sum will make the entire sum be null, so I'm certain those four fields do not contain any nulls.