Splunk Search

query to check is a list is [] or has values in it

wajeeh911
Engager

I'm having trouble querying the field attached in the image. I either want to know is its empty or has values in it. Does anyone know the proper syntax?

alt text

Tags (2)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@wajeeh911

In this case I suggest you to take benefit of any child field of failureRadar. Like, in my below sample example I have took A as child field of failureRadar. After renaming this field we can use it with where isnull( ( As @niketnilay said) to get failureRadar empty events. Please check my below Sample Search.

Events used:

{ "other_keys":"HI", "failureRadar":[]}

{ "other_keys":"HI", "failureRadar":[{"A":"B"}]}

Sample Search:

| makeresults | eval _raw="{ \"other_keys\":\"HI\", \"failureRadar\":[]}" | append [ | makeresults | eval _raw="{ \"other_keys\":\"HI\", \"failureRadar\":[{\"A\":\"B\"}]}" ] | kv
|rename failureRadar{}.A as myFlag
| where isnull(myFlag)

Can you please try below search ?

YOUR_SEARCH  |rename failureRadar{}.A as myFlag
| where isnull(myFlag)

Note: A is my child field of failureRadar. replace it with your original fields.

Try and let us know if any challenges. Please share some sample events for us to further assistance.

Thanks

0 Karma

marycordova
SplunkTrust
SplunkTrust

can you just table the field and post the results so we can see what is there currently?

| table failureRadar

@marycordova
0 Karma

wajeeh911
Engager

@marycordova I'm not looking to table the results, I'm trying to query results only when the list is empty.

0 Karma

marycordova
SplunkTrust
SplunkTrust

Right but a table will let me see what your data looks like so I can help you

@marycordova
0 Karma

niketn
Legend

@wajeeh911 what is your current query? Can you post sample JSON (raw) for the two scenarios?
Have you tried the following filter?

| where isnull(failureRadar)
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...