How to remove some blank rows from the display of two JSON data sets comparison in Splunk?

12 Views Asked by At

I have 2 JSON data sets with some matching and missing keys in them. I am trying to compare them w.r.t some nested key values and mark them as equal or unequal.

The comparison is working fine but I am getting some blank rows with values in only the last column that I am defining as equal or unequal.

I am using the below query with appendcols. The data sets returned by the search queries would be as below in respective order:

 data1="{ 
    \"Sugar\": {
        \"prod_rate\" : \"50\",
        \"prod_qual\" : \"Good\"
    },
    \"Rice\": {
        \"prod_rate\" : \"80\",
        \"prod_qual\" : \"OK\"
    },
   \"Potato\": {
        \"prod_rate\" : \"87\",
        \"prod_qual\" : \"OK\"
    }
}"
 data2="{ 
    \"Sugar\": {
        \"prod_rate\" : \"50\",
        \"prod_qual\" : \"Good\"
    },
    \"Wheat\": {
        \"prod_rate\" : \"50\",
        \"prod_qual\" : \"Good\"
    
    }
}"

The query I am using is as below:

index = data1
| eval grain_name = json_array_to_mv(json_keys(data1))
|mvexpand grain_name
|eval data = json_extract(data1, grain_name), qual = json_extract(data, "prod_qual")
|table grain_name, qual
| appendcols [ search index=data2| eval grain_name2 = json_array_to_mv(json_keys(data2))
| mvexpand grain_name2
| eval data2 = json_extract(data2, grain_name2), qual2 = json_extract(data2, "prod_qual")]
|eval diff = if(match (qual, qual2), "equal", "unequal")
|table grain_name, qual, diff

Any help to remove the blank rows from the display would fix the bug.

Thanks

0

There are 0 best solutions below