topic Re: what happened to eval ifnull(,,)? in Splunk Enterprise

what happened to eval ifnull(,,)?

bochmann — Fri, 01 Oct 2021 13:30:09 GMT

Hi -

I have a few dashboards that use expressions like

eval var=ifnull(x,"true","false")

...which assigns "true" or "false" to var depending on x being NULL

Those dashboards still work, but I notice that ifnull() does not show up in any of the current documentation, and it seems the current way to get the same result would be

eval var=if(isnull(x),"true","false")

Did I miss some kind of deprecation of that syntax ages ago (must have been before 6.3.0), and it just happens to still be parsed?

Re: what happened to eval ifnull(,,)?

richgalloway — Fri, 01 Oct 2021 14:12:29 GMT

I can't say I've ever seen ifnull documented, but system/default/searchbnf.conf says it's an alias for coalesce.

Re: what happened to eval ifnull(,,)?

bochmann — Fri, 01 Oct 2021 14:29:34 GMT

Huh. Reading the documentation for coalesce, I can see how this happens to work for specific cases where you want to keep the original value of x if it's not NULL, and fill in something else if it is.

...which is not what I showed in my example above, but exactly what happens in the dashboard I'm looking at, and where the third parameter is just bogus. Ouch.