Splunk Search

how to fillnull json value pair using spath or some other command

surekhasplunk
Communicator
<notification-list xmlns="http://www......./restful/schema/response">
<added-instance preexisting="false">
<alarm id="12fffffa1">
<attribute id="0x10">abc</attribute>
<attribute id="0x11">machinename</attribute>
<attribute id="0x22"/>
/alarm>
</added-instance>

Above xml am storing as a json response in splunk and using spath to do further query.
But now the issue is if you see the last attribute the 0x22 doesn't have a value pair for the key and then the issue happens with orderly showing the table.

How to fill the value pair for that attribute with 0 value ?

Tags (2)
0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

Hi,

You could try with rex instead of spath. Something like this:

| makeresults | fields - _time
| eval myXML = "<notification-list xmlns=\"http://www......./restful/schema/response\">
 <added-instance preexisting=\"false\">
 <alarm id=\"12fffffa1\">
 <attribute id=\"0x10\">abc</attribute>
 <attribute id=\"0x11\">machinename</attribute>
 <attribute id=\"0x22\"/>
 </alarm>
 </added-instance>"
| rex field=myXML max_match=0 "(?msi)(?<attribute_line>\<attribute id\=.+?$)"
| mvexpand attribute_line
| rex field=attribute_line "id=\"(?<id>[^\"]+)\"(\/)?\>(?<attribute>[^\<]+)?"
| fillnull value=NULL attribute

Will produce something like the attached screenshot.
alt text
Hope that helps.

Regards,
J

View solution in original post

0 Karma

javiergn
SplunkTrust
SplunkTrust

Hi,

You could try with rex instead of spath. Something like this:

| makeresults | fields - _time
| eval myXML = "<notification-list xmlns=\"http://www......./restful/schema/response\">
 <added-instance preexisting=\"false\">
 <alarm id=\"12fffffa1\">
 <attribute id=\"0x10\">abc</attribute>
 <attribute id=\"0x11\">machinename</attribute>
 <attribute id=\"0x22\"/>
 </alarm>
 </added-instance>"
| rex field=myXML max_match=0 "(?msi)(?<attribute_line>\<attribute id\=.+?$)"
| mvexpand attribute_line
| rex field=attribute_line "id=\"(?<id>[^\"]+)\"(\/)?\>(?<attribute>[^\<]+)?"
| fillnull value=NULL attribute

Will produce something like the attached screenshot.
alt text
Hope that helps.

Regards,
J

0 Karma

javiergn
SplunkTrust
SplunkTrust

Hi @surekhasplunk, did this solve your problem? If so, please do not forget to accept the answer so that we can close the question and others can benefit from it.

Thanks, J

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...