topic Help with if "null" command in Splunk Enterprise

Help with if "null" command

super_saiyan — Thu, 28 Jul 2022 15:20:12 GMT

Hi splunkers,

I want to use "null" command in below query. If the message is "null" then it should replace with the below message otherwise it should only display the already extracted message.

| eval message= if(Actor="superman","super hero", if(Actor="emma watson","model"))

Thanks.

Re: If "null" command

inventsekar — Thu, 28 Jul 2022 14:47:25 GMT

Hi @super_saiyan ... please check this isnull():

|makeresults | eval Actor="emma watson" | eval message = if(isnull(message),if(Actor="superman","super hero", if(Actor="emma watson","model", "not emma")),message) | table message

Re: If "null" command

somesoni2 — Thu, 28 Jul 2022 15:02:50 GMT

Give this a try

| eval message= coalesce(message,case(Actor="superman","super hero",Actor="emma watson","model", true(),"NA"))

Re: If "null" command

super_saiyan — Fri, 29 Jul 2022 06:11:30 GMT

I am getting error while using the below SPL Query

Could you please help me with that ?

appreciate your help.

Re: If "null" command

super_saiyan — Fri, 29 Jul 2022 06:14:03 GMT

Thanks for your quick response @somesoni2
could you please also provide the spl using "isnull" ?

Really appreciate your support.

Re: If "null" command

inventsekar — Fri, 29 Jul 2022 14:55:26 GMT

Hi @super_saiyan .. your "if" format was wrong.. pls check this..

|makeresults | eval Actor="emma watson" | eval message = if(isnull(message, null(),if(Actor="superman","super hero", if(Actor="emma watson","model", "not emma")) | table message

could you pls check this and update us with some more details:

>>> If the message is "null" then it should replace with the below message.

>>> otherwise it should only display the already extracted message.

Re: If "null" command

somesoni2 — Fri, 29 Jul 2022 15:46:39 GMT

| eval message= if(isnotnull(message),message,case(Actor="superman","super hero",Actor="emma watson","model", true(),"NA"))