Splunk Search

Can spath cater for missing values in an array?

ewanbrown
Path Finder

Hi,

I have a nested array and I want to compare values across

I've a query that works, apart from when a value is missing (the whole JSON is not present rather than it is empty)

The query snippet is ... | spath output=my_one path=bean.test{}.one | spath output=my_two path=bean.test{}.two ...

In the example with this data below I want my_two to have two values, 45 and null, not one value of 45

    {test}
    {
          one: 23
          two: 45
         three: 12
    }
    {
          one: 34
          three: 67
   }

Can I use spath for this, or is there another way?

Thanks

DalJeanis
Legend

Multivalue fields in Splunk do not contain elements with null values, so there would never be an output field that had a "null" in a multivalue slot.

Thus, if you want to compare to the two items, you are going to have to extract them individually as a workaround.

  | spath output=my_one0 path=bean.test{0}.one 
  | spath output=my_one1 path=bean.test{1}.one 
  | spath output=my_two0 path=bean.test{0}.two 
  | spath output=my_two1 path=bean.test{1}.two
0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...