topic Error while creating eval expression for calculated fields in data models in Splunk Search

Error while creating eval expression for calculated fields in data models

pdantuuri0411 — Thu, 19 Sep 2019 19:16:47 GMT

I have a data model and defined about 5 fields. But one of the fields doesnt always have a value. I want it to show as "null" when there is no value in the log. So for this particular field, I created it as a calculated field(systemid) and gave an eval expression systemid=if(isnull(systemid),"NULL",systemid). Now I get the error "Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr])."

Re: Error while creating eval expression for calculated fields in data models

richgalloway — Thu, 19 Sep 2019 20:00:50 GMT

What you have should work. Try this alternative, however: systemid = coalesce(systemid, "NULL").

Re: Error while creating eval expression for calculated fields in data models

pdantuuri0411 — Thu, 19 Sep 2019 20:18:57 GMT

Thank you for the reply @rickgalloway

I just copy pasted systemid = coalesce(systemid, "NULL") in eval expression in calculated fields and I get the same error Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr]).

Regards.