Splunk Search

Why are some values from events in splunk query returning NULL?

labaningombam
Explorer

Hi,

I have the following event as an example.

 

Properties: { [-]
Path: /v1.0/locations/branches
QueryString: ?branchNumbers=5318&
RequestPath: /v1.0/locations/branches
StatusCode: 404
TraceId: 3f39adaf-ae24-44f4-b5cb-f8c49be023a0
}

 

I am trying to query this using the below search:

 

index=myIndex "Properties.RequestPath"!="*/v1*/events/*" "Properties.RequestPath"!="*_status*" "Properties.StatusCode">399 "Properties.TraceId"!="" | dedup "Properties.TraceId" | table "Properties.RequestPath" "Properties.TraceId "Properties.StatusCode" "Properties.QueryString"

 

 

The above query is returning the RequestPath and the TraceId just fine. But StatusCode and QueryString are all blank and when I check the tab, it says NULL.

 

Can anyone please help?

Labels (2)
0 Karma

labaningombam
Explorer

Here is an example of an actual event when I don't use Table on my query:

index=myIndex "Properties.RequestPath"!="*/v1*/events/*" "Properties.RequestPath"!="*_status*" "Properties.StatusCode">399 "Properties.TraceId"!="" | dedup "Properties.TraceId"

 

Event:

   Properties: { [-]
     Path: /v1.0/locations/branches
     QueryString: ?branchNumbers=5318&
     RequestPath: /v1.0/locations/branches
     StatusCode: 404
     TraceId: 3f39adaf-ae24-44f4-b5cb-f8c49be023a0
   }

 

Attached is the screenshot of the result when I use table.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

The event you illustrated is not a conformant JSON.  Is that raw text or did you take that from Splunk search output with "syntax highlighted"? (When highlighted, you can get raw text by clicking "Show as raw text".)

I am hypothesizing that Splunk did not automatically extract all fields.  Did you try

index=myIndex "Properties.RequestPath"!="*/v1*/events/*" "Properties.RequestPath"!="*_status*" "Properties.StatusCode">399 "Properties.TraceId"!="" | dedup "Properties.TraceId"
| spath path=Properties.QueryString ``` expect new field QueryString ```
| spath path=Properties.StatusCode ``` expect new field StatusCode ```
| table QueryString StatusCode
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Can you post raw sample (anonymized) data? Is it possible that raw data did not get extracted properly? (Your search requires Properties.StatusCode to be not null, so unlikely.) Also try stuff like

| spath path=Properties.QueryString ``` expect new field QueryString ```

to test extraction

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...