Splunk Search

How to filter out those with empty JSON field?

sanggonlee
New Member

My logs have a JSON field, like this:

{
  "foo": 5,
  "bar": {}
}

I'd like to filter out logs that have an empty JSON for the "bar" field, like in the above example.

How do I do that? I tried something like 

where len('bar{}') > 0

but didn't work.

Thank you so much

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Note bar is not an array, therefore bar{} does not exist.  In that sample data, bar is null.  So, to exclude them,

 

| where isnotnull(bar)

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this.

| where isnotnull("bar.*")
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

How to send events & findings from AWS to Splunk using Amazon EventBridge

Amazon EventBridge is a serverless service that uses events to connect application components together, making ...

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...