https://community.splunk.com/t5/Dashboards-Visualizations/Handling-Nulls/m-p/523962#M35426 <P>I suspect that strcat creates an empty string rather than a null field.&nbsp; You can verify/workaround that using</P><LI-CODE lang="markup">|strcat Key_1 Key_2 Key_3 Key_4 Testing_Key |eval Testing_Key=if(Testing_Key=="","N/A",Testing_Key)</LI-CODE> Fri, 09 Oct 2020 17:43:44 GMT richgalloway 2020-10-09T17:43:44Z https://community.splunk.com/t5/Dashboards-Visualizations/Handling-Nulls/m-p/523958#M35425 <P>Hi,</P><P>I am combining fields using strcat as shows below and I want to have "N/A" in the same field if result of strcat is Null. But for some reason, isnull or isnotnull command used after strcat is not identifying null values.&nbsp;</P><P>Am I missing something here ?&nbsp;</P><P>|strcat Key_1 Key_2 Key_3 Key_4 Testing_Key<BR />|eval Testing_Key=if(isnotnull(Testing_Key),Testing_Key,"N/A")</P><P>Result should be either value of Testing_Key when its not null and it should "N/A" when Testing_Key is Null.</P><P>Thanks,</P><P>Rohan Kinhikar</P> Fri, 09 Oct 2020 17:26:33 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Handling-Nulls/m-p/523958#M35425 Rgk_Trail 2020-10-09T17:26:33Z https://community.splunk.com/t5/Dashboards-Visualizations/Handling-Nulls/m-p/523962#M35426 <P>I suspect that strcat creates an empty string rather than a null field.&nbsp; You can verify/workaround that using</P><LI-CODE lang="markup">|strcat Key_1 Key_2 Key_3 Key_4 Testing_Key |eval Testing_Key=if(Testing_Key=="","N/A",Testing_Key)</LI-CODE> Fri, 09 Oct 2020 17:43:44 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Handling-Nulls/m-p/523962#M35426 richgalloway 2020-10-09T17:43:44Z