I'm having trouble querying the field attached in the image. I either want to know is its empty or has values in it. Does anyone know the proper syntax?
@wajeeh911
In this case I suggest you to take benefit of any child field of failureRadar
. Like, in my below sample example I have took A
as child field of failureRadar
. After renaming this field we can use it with where isnull(
( As @niketnilay said) to get failureRadar
empty events. Please check my below Sample Search.
Events used:
{ "other_keys":"HI", "failureRadar":[]}
{ "other_keys":"HI", "failureRadar":[{"A":"B"}]}
Sample Search:
| makeresults | eval _raw="{ \"other_keys\":\"HI\", \"failureRadar\":[]}" | append [ | makeresults | eval _raw="{ \"other_keys\":\"HI\", \"failureRadar\":[{\"A\":\"B\"}]}" ] | kv
|rename failureRadar{}.A as myFlag
| where isnull(myFlag)
Can you please try below search ?
YOUR_SEARCH |rename failureRadar{}.A as myFlag
| where isnull(myFlag)
Note: A
is my child field of failureRadar
. replace it with your original fields.
Try and let us know if any challenges. Please share some sample events for us to further assistance.
Thanks
can you just table the field and post the results so we can see what is there currently?
| table failureRadar
@marycordova I'm not looking to table the results, I'm trying to query results only when the list is empty.
Right but a table will let me see what your data looks like so I can help you
@wajeeh911 what is your current query? Can you post sample JSON (raw) for the two scenarios?
Have you tried the following filter?
| where isnull(failureRadar)