Splunk Search

query to check is a list is [] or has values in it

wajeeh911
Engager

I'm having trouble querying the field attached in the image. I either want to know is its empty or has values in it. Does anyone know the proper syntax?

alt text

Tags (2)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@wajeeh911

In this case I suggest you to take benefit of any child field of failureRadar. Like, in my below sample example I have took A as child field of failureRadar. After renaming this field we can use it with where isnull( ( As @niketnilay said) to get failureRadar empty events. Please check my below Sample Search.

Events used:

{ "other_keys":"HI", "failureRadar":[]}

{ "other_keys":"HI", "failureRadar":[{"A":"B"}]}

Sample Search:

| makeresults | eval _raw="{ \"other_keys\":\"HI\", \"failureRadar\":[]}" | append [ | makeresults | eval _raw="{ \"other_keys\":\"HI\", \"failureRadar\":[{\"A\":\"B\"}]}" ] | kv
|rename failureRadar{}.A as myFlag
| where isnull(myFlag)

Can you please try below search ?

YOUR_SEARCH  |rename failureRadar{}.A as myFlag
| where isnull(myFlag)

Note: A is my child field of failureRadar. replace it with your original fields.

Try and let us know if any challenges. Please share some sample events for us to further assistance.

Thanks

0 Karma

marycordova
SplunkTrust
SplunkTrust

can you just table the field and post the results so we can see what is there currently?

| table failureRadar

@marycordova
0 Karma

wajeeh911
Engager

@marycordova I'm not looking to table the results, I'm trying to query results only when the list is empty.

0 Karma

marycordova
SplunkTrust
SplunkTrust

Right but a table will let me see what your data looks like so I can help you

@marycordova
0 Karma

niketn
Legend

@wajeeh911 what is your current query? Can you post sample JSON (raw) for the two scenarios?
Have you tried the following filter?

| where isnull(failureRadar)
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...