Splunk Search

How to string search for the empty value

lamnguyentt1
Explorer

Dear professional, 

I have a search like this

index="hcg_oapi_prod" relatedPersons

And the search value is store in attached image.

Then, I want to add a filter to search the log that have "relatedPersons":[] only, like this

2022-02-28 13:18:24.253 [c8058db8c5664bd1b3c49b749b607df8/c8058db8c57dcac5] - DEBUG OncePerRequestFilter - obtained request content: {"offerCode":"aaaa","application":{"applicantPerson":{"name":{"firstName":"aaa","middleName":"aaa","lastName":"aaa"},"gender":"MALE","birthDate":"1aaa","addresses":[],"phoneNumbers":[{"phoneType":"PRIMARY_MOBILE","number":"11111","verificationID":"ascve"}],"identificationDocuments":[{"type":"ID_CARD","number":"2222"}]},"additionalDocuments":[{"documentType":"PHOTO_PERSON","documentInfo":[],"photoTakingResult":"TECHNICAL_PROBLEM"},{"documentType":"MEDICAL_INS_CARD","documentInfo":[{"type":"INSURANCE_CARD_NUM"}]},{"documentType":"BANK_STATMENT_3","documentInfo":[{"type":"BANK_ACCOUNT_NUM"}]}],"employmentInfo":{"econimicalStatus":"OTHER","monthlyIncome":{"amount":8000000.0,"currency":"VND"},"monthlyPaymentLoan":{"amount":0.0,"currency":"USD"}},"relatedPersons":[]},"userStatistics":[{"key":"tongdun_appname","value":"HomeCredit_vn_and"},{"key":"tongdun_blackbox","value":"eyu"},{"key":"tongdun_source","value":"dqshand"},{"key":"tracksessionid","value":"0459588f-b583-4cf0-954c-8ecbbcc31a8e_16460289063825295"}]}

Please help me.

lamnguyentt1_1-1646030428270.png

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @lamnguyentt1,

let me understand: do you want to search for the string relatedPersons or for the string "relatedPersons":[] ?

if the first your search is correct.

If the second, there are some special chars so it's better to use the regex command:

| regex "\"relatedPersons\":\[\]"

Ciao.

Giuseppe

View solution in original post

lamnguyentt1
Explorer

Thank you for your help Mr. @gcusello . 

I want to search for the string "relatedPersons":[]

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @lamnguyentt1,

let me understand: do you want to search for the string relatedPersons or for the string "relatedPersons":[] ?

if the first your search is correct.

If the second, there are some special chars so it's better to use the regex command:

| regex "\"relatedPersons\":\[\]"

Ciao.

Giuseppe

Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Cultivate Your Career Growth with Fresh Splunk Training

Growth doesn’t just happen—it’s nurtured. Like tending a garden, developing your Splunk skills takes the right ...

Introducing a Smarter Way to Discover Apps on Splunkbase

We’re excited to announce the launch of a foundational enhancement to Splunkbase: App Tiering.  Because we’ve ...