Splunk Search

How to filter by if a field exist?

YatMan
Explorer

My sample events look like this , API logs

 

{
   location:  Southeast Asia,  
   properties:  {  
	backendMethod:  GET  
	errors:  [ 
	    {some huge nested object},
	    {some huge nested object}
       ]
   }
}

 

I want to search only the events with the "errors" field. If the API is successful, it does not have this "errors" field, and I don't want to search them.

I have tried
{baseSearch}  | where mvcount('properties.errors') > 0 , this return nothing
{baseSearch}  | where mvcount("properties.errors") > 0 , returning even the events without the "errors" field
{baseSearch}  | where isnotnull('properties.errors'), this return nothing
{baseSearch}  | where isnotnull("properties.errors"),returning even the events without the "errors" field
{baseSearch}  |  "properties.errors"=*.  ,  this return nothing

I just need something simple like {baseSearch}  |  where exist(properties.errors), what is the most simple way


Labels (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Several possibilities.  One is to find a common subnode in those huge nested objects.  For example, if 'id' is common in the array, do

| where isnotnull('properties.errors{}.id')

Another could be to run a second spath on the error (which can be beneficial for further processing, anyway)

| spath path=properties.errors{}
| where isnotnull('properties.errors{}')

(As always, remember to add {} to represent a JSON array.)  Hope this helps.

 

View solution in original post

0 Karma

YatMan
Explorer

This is working, thank you!

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Several possibilities.  One is to find a common subnode in those huge nested objects.  For example, if 'id' is common in the array, do

| where isnotnull('properties.errors{}.id')

Another could be to run a second spath on the error (which can be beneficial for further processing, anyway)

| spath path=properties.errors{}
| where isnotnull('properties.errors{}')

(As always, remember to add {} to represent a JSON array.)  Hope this helps.

 

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...