Splunk Search

Can spath cater for missing values in an array?

Path Finder

Hi,

I have a nested array and I want to compare values across

I've a query that works, apart from when a value is missing (the whole JSON is not present rather than it is empty)

The query snippet is ... | spath output=my_one path=bean.test{}.one | spath output=my_two path=bean.test{}.two ...

In the example with this data below I want my_two to have two values, 45 and null, not one value of 45

    {test}
    {
          one: 23
          two: 45
         three: 12
    }
    {
          one: 34
          three: 67
   }

Can I use spath for this, or is there another way?

Thanks

SplunkTrust
SplunkTrust

Multivalue fields in Splunk do not contain elements with null values, so there would never be an output field that had a "null" in a multivalue slot.

Thus, if you want to compare to the two items, you are going to have to extract them individually as a workaround.

  | spath output=my_one0 path=bean.test{0}.one 
  | spath output=my_one1 path=bean.test{1}.one 
  | spath output=my_two0 path=bean.test{0}.two 
  | spath output=my_two1 path=bean.test{1}.two
0 Karma