https://community.splunk.com/t5/Splunk-Search/how-to-set-null-value/m-p/377042#M110627 <P>use null() instead of "null"</P> Mon, 16 Mar 2020 18:37:11 GMT zihenggong 2020-03-16T18:37:11Z https://community.splunk.com/t5/Splunk-Search/how-to-set-null-value/m-p/377040#M110625 <P>If the field value is null, the value is null, and if it is not controlled, it is still the original value</P> <P>I want to get a field value ,if it is null ,I set it null,if not ,I hope it still the original value</P> <P>I use :</P> <PRE><CODE>index = abc_text | eval Codelocation = if(isnull(Codelocation), "null",Codelocation)|stats max(_time) as _time values(Codelocation) as codelocation by source </CODE></PRE> <P>It did not achieve the desired effect.</P> Tue, 06 Nov 2018 01:29:05 GMT https://community.splunk.com/t5/Splunk-Search/how-to-set-null-value/m-p/377040#M110625 WXY 2018-11-06T01:29:05Z https://community.splunk.com/t5/Splunk-Search/how-to-set-null-value/m-p/377041#M110626 <P>@WXY, just a clarification - if the value is null why do you want to set it again to null ? Do you mean you want to convert "space" to null.</P> <P>Anyway try this <CODE>|eval Codelocation = if(isnull(Codelocation), null(),Codelocation)</CODE></P> Tue, 06 Nov 2018 02:33:27 GMT https://community.splunk.com/t5/Splunk-Search/how-to-set-null-value/m-p/377041#M110626 renjith_nair 2018-11-06T02:33:27Z https://community.splunk.com/t5/Splunk-Search/how-to-set-null-value/m-p/377042#M110627 <P>use null() instead of "null"</P> Mon, 16 Mar 2020 18:37:11 GMT https://community.splunk.com/t5/Splunk-Search/how-to-set-null-value/m-p/377042#M110627 zihenggong 2020-03-16T18:37:11Z