Why are some values from events in splunk query returning NULL?

[labaningombam]

Hi,

I have the following event as an example.

Properties: { [-]
Path: /v1.0/locations/branches
QueryString: ?branchNumbers=5318&
RequestPath: /v1.0/locations/branches
StatusCode: 404
TraceId: 3f39adaf-ae24-44f4-b5cb-f8c49be023a0
}

I am trying to query this using the below search:

index=myIndex "Properties.RequestPath"!="*/v1*/events/*" "Properties.RequestPath"!="*_status*" "Properties.StatusCode">399 "Properties.TraceId"!="" | dedup "Properties.TraceId" | table "Properties.RequestPath" "Properties.TraceId "Properties.StatusCode" "Properties.QueryString"

The above query is returning the RequestPath and the TraceId just fine. But StatusCode and QueryString are all blank and when I check the tab, it says NULL.

Can anyone please help?

[labaningombam]

Here is an example of an actual event when I don't use Table on my query:

index=myIndex "Properties.RequestPath"!="*/v1*/events/*" "Properties.RequestPath"!="*_status*" "Properties.StatusCode">399 "Properties.TraceId"!="" | dedup "Properties.TraceId"

Event:

   Properties: { [-]
     Path: /v1.0/locations/branches
     QueryString: ?branchNumbers=5318&
     RequestPath: /v1.0/locations/branches
     StatusCode: 404
     TraceId: 3f39adaf-ae24-44f4-b5cb-f8c49be023a0
   }

Attached is the screenshot of the result when I use table.

[yuanliu]

The event you illustrated is not a conformant JSON.  Is that raw text or did you take that from Splunk search output with "syntax highlighted"? (When highlighted, you can get raw text by clicking "Show as raw text".)

I am hypothesizing that Splunk did not automatically extract all fields.  Did you try

index=myIndex "Properties.RequestPath"!="*/v1*/events/*" "Properties.RequestPath"!="*_status*" "Properties.StatusCode">399 "Properties.TraceId"!="" | dedup "Properties.TraceId"
| spath path=Properties.QueryString ``` expect new field QueryString ```
| spath path=Properties.StatusCode ``` expect new field StatusCode ```
| table QueryString StatusCode

[yuanliu]

Can you post raw sample (anonymized) data? Is it possible that raw data did not get extracted properly? (Your search requires Properties.StatusCode to be not null, so unlikely.) Also try stuff like

| spath path=Properties.QueryString ``` expect new field QueryString ```

to test extraction