https://community.splunk.com/t5/Splunk-Search/use-eval-to-return-field-that-is-not-null/m-p/73763#M18489 <P>I guess the separating comma is missing:</P> <PRE><CODE>eval new_field=if(field1!="NULL","field1--".value1."field2--".value2, field2) </CODE></PRE> Wed, 13 Jun 2012 12:55:34 GMT ziegfried 2012-06-13T12:55:34Z https://community.splunk.com/t5/Splunk-Search/use-eval-to-return-field-that-is-not-null/m-p/73762#M18488 <P>i working on a query to display fields with data others than the string "NULL".. <BR /> and i am trying to use eval.</P> <PRE><CODE>eval new_field=if(field1 !="NULL" "field1--".value1."field2--".value2, field2) </CODE></PRE> <P>then continue for the next eval.. then pipe to next eval.</P> <P>However, i cannot get the result out.. is it my syntax error? </P> Wed, 13 Jun 2012 01:47:46 GMT https://community.splunk.com/t5/Splunk-Search/use-eval-to-return-field-that-is-not-null/m-p/73762#M18488 sg5258 2012-06-13T01:47:46Z https://community.splunk.com/t5/Splunk-Search/use-eval-to-return-field-that-is-not-null/m-p/73763#M18489 <P>I guess the separating comma is missing:</P> <PRE><CODE>eval new_field=if(field1!="NULL","field1--".value1."field2--".value2, field2) </CODE></PRE> Wed, 13 Jun 2012 12:55:34 GMT https://community.splunk.com/t5/Splunk-Search/use-eval-to-return-field-that-is-not-null/m-p/73763#M18489 ziegfried 2012-06-13T12:55:34Z