Splunk Search

How to filter out those with empty JSON field?

sanggonlee
New Member

My logs have a JSON field, like this:

{
  "foo": 5,
  "bar": {}
}

I'd like to filter out logs that have an empty JSON for the "bar" field, like in the above example.

How do I do that? I tried something like 

where len('bar{}') > 0

but didn't work.

Thank you so much

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Note bar is not an array, therefore bar{} does not exist.  In that sample data, bar is null.  So, to exclude them,

 

| where isnotnull(bar)

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this.

| where isnotnull("bar.*")
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...