Why is Splunk converting zero values to null values in JSON data and how to fix this?

[shikhanshu]

I have some JSON data I am sending to Splunk. E.g.

{ "Quality": {
                "Errors Reported": 3,
                "Errors Waived": 0,
                "Warnings Reported": 0,
                "Warnings Waived": 0
}}

The values are integer. Non zero ones show up fine in Splunk. But the ones that are 0, Splunk shows them as null.
That is incorrect behavior, because 0 is not null. I might actually have some other keys in the JSON as null and they are not 0.

How do I rectify this?

[martin_mueller · Accepted solution]

6.1.3... playing around a bit more it seems to me as if the JSONTree syntax highlighter may be broken. When you view the raw event it shows 0, when you do maths it uses 0, but when you show the syntax highlighted tree it shows null.

[shikhanshu]

Done. Case number 196886

[j6white]

Was this issue resolved in 6.2?

[Wiggy]

This is a known issue (SPL-93801) which is fixed in 6.1.6 and in 6.2.0

[martin_mueller]

Remember to submit a ticket with Splunk Support to eventually get this fixed some day.

[martin_mueller]

You can't convert comments to answers yet, needs more karma.

[shikhanshu]

Indeed! The highlighter wrongly shows null, but when I do any math, or even simply tabulate the data (using fields and table commands), things are all good.

Thanks Martin for spending time on investigating this and providing an answer.

How can I mark Martin's last comment as an answer?

[shikhanshu]

I am on 6.1, What about you?

For me, when I search in Splunk and the event comes back, it looks like this:
{ "Quality": {
"Errors Reported": 3,
"Errors Waived": null,
"Warnings Reported": null,
"Warnings Waived": null
}}

[martin_mueller]

I've just indexed your example and the values come out as zero rather than null. What version are you on?

I'd upload a screenshot, but Splunk Answers thinks I need more karma to do that...

...hosting elsewhere seems to work though. Adding a null field to that sum will make the entire sum be null, so I'm certain those four fields do not contain any nulls.