Splunk Search

How to fillnull json value pair in a subpath ?

emallinger
Communicator

Hello,

I'm faced today with something I do not understand.

Here the structure of my event (JSON structured) :

 

{
dateReponse: 1618309228736
dateRequete: 1618309228622
id: 4572d
reponse: {
dossier: [
{
$c: PERSONNE
$i: 1
$l: 1
dateCreation: 1477036197000
dateModification: 1495047526000
id: 1
}
{
$c: IDENTITE
$i: 2
$l: 1
dateCreation: 1477036197000
dateModification: 1513858108603
nom: NOM1
prenom: prenom1
}
{
$c: IDENTITE
$i: 3
$l: 1
dateCreation: 1479206837000
dateModification: 1513858108603
nom: NOM2
}
]
}
}

 

 

I'd like to fillnum the field reponse.dossier{}.prenom with "unknown" when not present.

The content keep being blank.

I tried adding mvexpand and spath (even if it's already json parsed), no luck.

| mvexpand reponse.dossier{}.nom
| spath input=reponse.dossier{}
| fillnull value="unkown" reponse.dossier{}.prenom

 

I've tried adding a complete new field after reponse.dossier{}.prenom in the fillnull command, it worked just fine for the new field. Still not for my reponse.dossier{}.prenom.

I think I missed something, somewhere.

Any suggestion ?

Thanks in advance,

Ema

Labels (1)
Tags (2)
0 Karma
1 Solution

manjunathmeti
Champion

hi @emallinger,
You need to expand all the child dictionaries in the field dossier. Try this, here the field name will be prenom instead of reponse.dossier{}.prenom.

index=index spurcetype=sourcetype
| rex max_match=0 "(?<event>\{[^\{]+?\})" 
| mvexpand event 
| spath input=event 
| fillnull value="unkown" prenom

 

If this reply helps you, a like would be appreciated.

 

View solution in original post

emallinger
Communicator

Hi !

Thank you very much !

Now I just have to integrate this into my whole request, but it'll be fine .

Regards,

Ema

0 Karma

manjunathmeti
Champion

hi @emallinger,
You need to expand all the child dictionaries in the field dossier. Try this, here the field name will be prenom instead of reponse.dossier{}.prenom.

index=index spurcetype=sourcetype
| rex max_match=0 "(?<event>\{[^\{]+?\})" 
| mvexpand event 
| spath input=event 
| fillnull value="unkown" prenom

 

If this reply helps you, a like would be appreciated.

 

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...