https://community.splunk.com/t5/Splunk-Search/case-and-isnull-for-multiple-fields/m-p/111862#M29332 <P>Try this,</P> <PRE><CODE>| eval main = case(isnotnull(test1), test1, isnotnull(test2), test2, isnotnull(test3), test3, isnotnull(test4), test4, 1=1 , "All Test Are Null") </CODE></PRE> <P>Main's value should be test1 / test2 / test3 / test4 in-case test1 is empty option goes to test2, if test2 is empty then option goes to test 3 and test4 like wise.</P> <P>If suppose test1, test2, test3, test4 contains value then test1 would be assigned to main. if not "All Test are Null" will be assigned to main.</P> <P>Hope this will help you.</P> Thu, 13 Nov 2014 02:45:32 GMT vasanthmss 2014-11-13T02:45:32Z https://community.splunk.com/t5/Splunk-Search/case-and-isnull-for-multiple-fields/m-p/111861#M29331 <P>HI,</P> <P>Working on a query that if one field is null then it uses another field and if that field isnull it uses another. Will case work like that in a linear operation left-to-right or is there a better option?</P> <P>eval main=case(isnull(test1),test2,test1,isnull(test2),test3,test2,isnull(test3),test4,test3,1=1,"All Test Are Null)</P> Thu, 13 Nov 2014 02:17:11 GMT https://community.splunk.com/t5/Splunk-Search/case-and-isnull-for-multiple-fields/m-p/111861#M29331 subtrakt 2014-11-13T02:17:11Z https://community.splunk.com/t5/Splunk-Search/case-and-isnull-for-multiple-fields/m-p/111862#M29332 <P>Try this,</P> <PRE><CODE>| eval main = case(isnotnull(test1), test1, isnotnull(test2), test2, isnotnull(test3), test3, isnotnull(test4), test4, 1=1 , "All Test Are Null") </CODE></PRE> <P>Main's value should be test1 / test2 / test3 / test4 in-case test1 is empty option goes to test2, if test2 is empty then option goes to test 3 and test4 like wise.</P> <P>If suppose test1, test2, test3, test4 contains value then test1 would be assigned to main. if not "All Test are Null" will be assigned to main.</P> <P>Hope this will help you.</P> Thu, 13 Nov 2014 02:45:32 GMT https://community.splunk.com/t5/Splunk-Search/case-and-isnull-for-multiple-fields/m-p/111862#M29332 vasanthmss 2014-11-13T02:45:32Z https://community.splunk.com/t5/Splunk-Search/case-and-isnull-for-multiple-fields/m-p/111863#M29333 <P>Take a look at the eval coalesce function - as the documentation states</P> <BLOCKQUOTE> <P>This function takes an arbitrary number of arguments and returns the first value that is not null.</P> </BLOCKQUOTE> Thu, 13 Nov 2014 14:29:28 GMT https://community.splunk.com/t5/Splunk-Search/case-and-isnull-for-multiple-fields/m-p/111863#M29333 davebrooking 2014-11-13T14:29:28Z https://community.splunk.com/t5/Splunk-Search/case-and-isnull-for-multiple-fields/m-p/111864#M29334 <P>Thanks - worked like a dream</P> Thu, 13 Nov 2014 22:14:11 GMT https://community.splunk.com/t5/Splunk-Search/case-and-isnull-for-multiple-fields/m-p/111864#M29334 subtrakt 2014-11-13T22:14:11Z https://community.splunk.com/t5/Splunk-Search/case-and-isnull-for-multiple-fields/m-p/111865#M29335 <P>Cheers !!!</P> Fri, 14 Nov 2014 12:40:32 GMT https://community.splunk.com/t5/Splunk-Search/case-and-isnull-for-multiple-fields/m-p/111865#M29335 vasanthmss 2014-11-14T12:40:32Z