Splunk Search

How to filter by if a field exist?

YatMan
Explorer

My sample events look like this , API logs

 

{
   location:  Southeast Asia,  
   properties:  {  
	backendMethod:  GET  
	errors:  [ 
	    {some huge nested object},
	    {some huge nested object}
       ]
   }
}

 

I want to search only the events with the "errors" field. If the API is successful, it does not have this "errors" field, and I don't want to search them.

I have tried
{baseSearch}  | where mvcount('properties.errors') > 0 , this return nothing
{baseSearch}  | where mvcount("properties.errors") > 0 , returning even the events without the "errors" field
{baseSearch}  | where isnotnull('properties.errors'), this return nothing
{baseSearch}  | where isnotnull("properties.errors"),returning even the events without the "errors" field
{baseSearch}  |  "properties.errors"=*.  ,  this return nothing

I just need something simple like {baseSearch}  |  where exist(properties.errors), what is the most simple way


Labels (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Several possibilities.  One is to find a common subnode in those huge nested objects.  For example, if 'id' is common in the array, do

| where isnotnull('properties.errors{}.id')

Another could be to run a second spath on the error (which can be beneficial for further processing, anyway)

| spath path=properties.errors{}
| where isnotnull('properties.errors{}')

(As always, remember to add {} to represent a JSON array.)  Hope this helps.

 

View solution in original post

0 Karma

YatMan
Explorer

This is working, thank you!

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Several possibilities.  One is to find a common subnode in those huge nested objects.  For example, if 'id' is common in the array, do

| where isnotnull('properties.errors{}.id')

Another could be to run a second spath on the error (which can be beneficial for further processing, anyway)

| spath path=properties.errors{}
| where isnotnull('properties.errors{}')

(As always, remember to add {} to represent a JSON array.)  Hope this helps.

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...