Splunk Search

How to filter out those with empty JSON field?

sanggonlee
New Member

My logs have a JSON field, like this:

{
  "foo": 5,
  "bar": {}
}

I'd like to filter out logs that have an empty JSON for the "bar" field, like in the above example.

How do I do that? I tried something like 

where len('bar{}') > 0

but didn't work.

Thank you so much

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Note bar is not an array, therefore bar{} does not exist.  In that sample data, bar is null.  So, to exclude them,

 

| where isnotnull(bar)

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this.

| where isnotnull("bar.*")
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...