How to get length of array in SPL2 splunk query

Question

My splunk data looks like this

{
    "name": "john",
    "foo": []
}

sometimes foo is empty, and sometimes it has data in it. I want to query for all the EMPTY using SPL2.

I tried foo=[] and I tried foo="[]" but neither works.

Answer 1

You can try the following syntax :

<your_search>
| where isnull('foo{}')