Splunk Search

Can spath cater for missing values in an array?

ewanbrown
Path Finder

Hi,

I have a nested array and I want to compare values across

I've a query that works, apart from when a value is missing (the whole JSON is not present rather than it is empty)

The query snippet is ... | spath output=my_one path=bean.test{}.one | spath output=my_two path=bean.test{}.two ...

In the example with this data below I want my_two to have two values, 45 and null, not one value of 45

    {test}
    {
          one: 23
          two: 45
         three: 12
    }
    {
          one: 34
          three: 67
   }

Can I use spath for this, or is there another way?

Thanks

DalJeanis
Legend

Multivalue fields in Splunk do not contain elements with null values, so there would never be an output field that had a "null" in a multivalue slot.

Thus, if you want to compare to the two items, you are going to have to extract them individually as a workaround.

  | spath output=my_one0 path=bean.test{0}.one 
  | spath output=my_one1 path=bean.test{1}.one 
  | spath output=my_two0 path=bean.test{0}.two 
  | spath output=my_two1 path=bean.test{1}.two
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...