query to check is a list is [] or has values in it

[wajeeh911]

I'm having trouble querying the field attached in the image. I either want to know is its empty or has values in it. Does anyone know the proper syntax?

[kamlesh_vaghela]

@wajeeh911

In this case I suggest you to take benefit of any child field of failureRadar. Like, in my below sample example I have took A as child field of failureRadar. After renaming this field we can use it with where isnull( ( As @niketnilay said) to get failureRadar empty events. Please check my below Sample Search.

Events used:

{ "other_keys":"HI", "failureRadar":[]}

{ "other_keys":"HI", "failureRadar":[{"A":"B"}]}

Sample Search:

| makeresults | eval _raw="{ \"other_keys\":\"HI\", \"failureRadar\":[]}" | append [ | makeresults | eval _raw="{ \"other_keys\":\"HI\", \"failureRadar\":[{\"A\":\"B\"}]}" ] | kv
|rename failureRadar{}.A as myFlag
| where isnull(myFlag)

Can you please try below search ?

YOUR_SEARCH  |rename failureRadar{}.A as myFlag
| where isnull(myFlag)

Note: A is my child field of failureRadar. replace it with your original fields.

Try and let us know if any challenges. Please share some sample events for us to further assistance.

Thanks

[marycordova]

can you just table the field and post the results so we can see what is there currently?

| table failureRadar

[wajeeh911]

@marycordova I'm not looking to table the results, I'm trying to query results only when the list is empty.

[marycordova]

Right but a table will let me see what your data looks like so I can help you

[niketn]

@wajeeh911 what is your current query? Can you post sample JSON (raw) for the two scenarios?
Have you tried the following filter?

| where isnull(failureRadar)