Splunk Search

Can spath cater for missing values in an array?

ewanbrown
Path Finder

Hi,

I have a nested array and I want to compare values across

I've a query that works, apart from when a value is missing (the whole JSON is not present rather than it is empty)

The query snippet is ... | spath output=my_one path=bean.test{}.one | spath output=my_two path=bean.test{}.two ...

In the example with this data below I want my_two to have two values, 45 and null, not one value of 45

    {test}
    {
          one: 23
          two: 45
         three: 12
    }
    {
          one: 34
          three: 67
   }

Can I use spath for this, or is there another way?

Thanks

DalJeanis
SplunkTrust
SplunkTrust

Multivalue fields in Splunk do not contain elements with null values, so there would never be an output field that had a "null" in a multivalue slot.

Thus, if you want to compare to the two items, you are going to have to extract them individually as a workaround.

  | spath output=my_one0 path=bean.test{0}.one 
  | spath output=my_one1 path=bean.test{1}.one 
  | spath output=my_two0 path=bean.test{0}.two 
  | spath output=my_two1 path=bean.test{1}.two
0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...