Splunk Search

How to fillnull json value pair in a subpath ?

emallinger
Communicator

Hello,

I'm faced today with something I do not understand.

Here the structure of my event (JSON structured) :

 

{
dateReponse: 1618309228736
dateRequete: 1618309228622
id: 4572d
reponse: {
dossier: [
{
$c: PERSONNE
$i: 1
$l: 1
dateCreation: 1477036197000
dateModification: 1495047526000
id: 1
}
{
$c: IDENTITE
$i: 2
$l: 1
dateCreation: 1477036197000
dateModification: 1513858108603
nom: NOM1
prenom: prenom1
}
{
$c: IDENTITE
$i: 3
$l: 1
dateCreation: 1479206837000
dateModification: 1513858108603
nom: NOM2
}
]
}
}

 

 

I'd like to fillnum the field reponse.dossier{}.prenom with "unknown" when not present.

The content keep being blank.

I tried adding mvexpand and spath (even if it's already json parsed), no luck.

| mvexpand reponse.dossier{}.nom
| spath input=reponse.dossier{}
| fillnull value="unkown" reponse.dossier{}.prenom

 

I've tried adding a complete new field after reponse.dossier{}.prenom in the fillnull command, it worked just fine for the new field. Still not for my reponse.dossier{}.prenom.

I think I missed something, somewhere.

Any suggestion ?

Thanks in advance,

Ema

Labels (1)
Tags (2)
0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

hi @emallinger,
You need to expand all the child dictionaries in the field dossier. Try this, here the field name will be prenom instead of reponse.dossier{}.prenom.

index=index spurcetype=sourcetype
| rex max_match=0 "(?<event>\{[^\{]+?\})" 
| mvexpand event 
| spath input=event 
| fillnull value="unkown" prenom

 

If this reply helps you, a like would be appreciated.

 

View solution in original post

emallinger
Communicator

Hi !

Thank you very much !

Now I just have to integrate this into my whole request, but it'll be fine .

Regards,

Ema

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

hi @emallinger,
You need to expand all the child dictionaries in the field dossier. Try this, here the field name will be prenom instead of reponse.dossier{}.prenom.

index=index spurcetype=sourcetype
| rex max_match=0 "(?<event>\{[^\{]+?\})" 
| mvexpand event 
| spath input=event 
| fillnull value="unkown" prenom

 

If this reply helps you, a like would be appreciated.

 

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...