Splunk Search

query to check is a list is [] or has values in it

wajeeh911
Engager

I'm having trouble querying the field attached in the image. I either want to know is its empty or has values in it. Does anyone know the proper syntax?

alt text

Tags (2)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@wajeeh911

In this case I suggest you to take benefit of any child field of failureRadar. Like, in my below sample example I have took A as child field of failureRadar. After renaming this field we can use it with where isnull( ( As @niketnilay said) to get failureRadar empty events. Please check my below Sample Search.

Events used:

{ "other_keys":"HI", "failureRadar":[]}

{ "other_keys":"HI", "failureRadar":[{"A":"B"}]}

Sample Search:

| makeresults | eval _raw="{ \"other_keys\":\"HI\", \"failureRadar\":[]}" | append [ | makeresults | eval _raw="{ \"other_keys\":\"HI\", \"failureRadar\":[{\"A\":\"B\"}]}" ] | kv
|rename failureRadar{}.A as myFlag
| where isnull(myFlag)

Can you please try below search ?

YOUR_SEARCH  |rename failureRadar{}.A as myFlag
| where isnull(myFlag)

Note: A is my child field of failureRadar. replace it with your original fields.

Try and let us know if any challenges. Please share some sample events for us to further assistance.

Thanks

0 Karma

marycordova
SplunkTrust
SplunkTrust

can you just table the field and post the results so we can see what is there currently?

| table failureRadar

@marycordova
0 Karma

wajeeh911
Engager

@marycordova I'm not looking to table the results, I'm trying to query results only when the list is empty.

0 Karma

marycordova
SplunkTrust
SplunkTrust

Right but a table will let me see what your data looks like so I can help you

@marycordova
0 Karma

niketn
Legend

@wajeeh911 what is your current query? Can you post sample JSON (raw) for the two scenarios?
Have you tried the following filter?

| where isnull(failureRadar)
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...