topic return events with null values in an eval function in Splunk Search https://community.splunk.com/t5/Splunk-Search/return-events-with-null-values-in-an-eval-function/m-p/157063#M44201 <P>I am using the below query, but few events in the logs don't have service_name values. They only have operation_name. I need to include these events in the results with only the operation name. Please help me.</P> <P>index=jms_logs sourcetype=perflogs | eval service_operation = service_name.".".operation_name | table service_operation | dedup service_operation | sort service_operation</P> <P>thanks.</P> Mon, 28 Sep 2020 18:25:44 GMT edookati 2020-09-28T18:25:44Z return events with null values in an eval function https://community.splunk.com/t5/Splunk-Search/return-events-with-null-values-in-an-eval-function/m-p/157063#M44201 <P>I am using the below query, but few events in the logs don't have service_name values. They only have operation_name. I need to include these events in the results with only the operation name. Please help me.</P> <P>index=jms_logs sourcetype=perflogs | eval service_operation = service_name.".".operation_name | table service_operation | dedup service_operation | sort service_operation</P> <P>thanks.</P> Mon, 28 Sep 2020 18:25:44 GMT https://community.splunk.com/t5/Splunk-Search/return-events-with-null-values-in-an-eval-function/m-p/157063#M44201 edookati 2020-09-28T18:25:44Z Re: return events with null values in an eval function https://community.splunk.com/t5/Splunk-Search/return-events-with-null-values-in-an-eval-function/m-p/157064#M44202 <P>Try this</P> <PRE><CODE>index=jms_logs sourcetype=perflogs | eval service_operation = coalesce(service_name.".","").operation_name | stats count by service_operation | table sort service_operation </CODE></PRE> <P>The stats will automatically remove duplicates and sort.</P> Thu, 11 Dec 2014 19:00:44 GMT https://community.splunk.com/t5/Splunk-Search/return-events-with-null-values-in-an-eval-function/m-p/157064#M44202 somesoni2 2014-12-11T19:00:44Z Re: return events with null values in an eval function https://community.splunk.com/t5/Splunk-Search/return-events-with-null-values-in-an-eval-function/m-p/157065#M44203 <P>thanks. it worked</P> Thu, 11 Dec 2014 20:49:50 GMT https://community.splunk.com/t5/Splunk-Search/return-events-with-null-values-in-an-eval-function/m-p/157065#M44203 edookati 2014-12-11T20:49:50Z