https://community.splunk.com/t5/Splunk-Search/What-does-the-coalesce-command-mean-in-this-Splunk-search/m-p/239838#M71268 <P>The <CODE>coalesce</CODE> command is essentially a simplified case or if-then-else statement. It returns the first of its arguments that is not null. In your example, fieldA is set to the empty string if it is null. See <A href="http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/CommonEvalFunctions">http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/CommonEvalFunctions</A>.</P> Wed, 16 Nov 2016 14:54:14 GMT richgalloway 2016-11-16T14:54:14Z https://community.splunk.com/t5/Splunk-Search/What-does-the-coalesce-command-mean-in-this-Splunk-search/m-p/239837#M71267 <P>What does the below coalesce command mean in this Splunk search? Any explanation would be appreciated</P> <PRE><CODE>eval fieldA=coalesce(fieldA,"") </CODE></PRE> Wed, 16 Nov 2016 14:44:29 GMT https://community.splunk.com/t5/Splunk-Search/What-does-the-coalesce-command-mean-in-this-Splunk-search/m-p/239837#M71267 pavanae 2016-11-16T14:44:29Z https://community.splunk.com/t5/Splunk-Search/What-does-the-coalesce-command-mean-in-this-Splunk-search/m-p/239838#M71268 <P>The <CODE>coalesce</CODE> command is essentially a simplified case or if-then-else statement. It returns the first of its arguments that is not null. In your example, fieldA is set to the empty string if it is null. See <A href="http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/CommonEvalFunctions">http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/CommonEvalFunctions</A>.</P> Wed, 16 Nov 2016 14:54:14 GMT https://community.splunk.com/t5/Splunk-Search/What-does-the-coalesce-command-mean-in-this-Splunk-search/m-p/239838#M71268 richgalloway 2016-11-16T14:54:14Z https://community.splunk.com/t5/Splunk-Search/What-does-the-coalesce-command-mean-in-this-Splunk-search/m-p/239839#M71269 <P>Hi pavanae,<BR /> are you sure that this function runs?<BR /> every way, coalesce "takes an arbitrary number of arguments and returns the first value that is not null", so there is no sense to put a null value in this function (see <A href="http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/CommonEvalFunctions">http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/CommonEvalFunctions</A>).<BR /> If you want to give to FieldA a different value when it's null, you have to use <CODE>eval FieldA=if(isnull(FieldA),"X",FieldA)</CODE>.<BR /> Bye.<BR /> Giuseppe</P> Wed, 16 Nov 2016 14:59:46 GMT https://community.splunk.com/t5/Splunk-Search/What-does-the-coalesce-command-mean-in-this-Splunk-search/m-p/239839#M71269 gcusello 2016-11-16T14:59:46Z https://community.splunk.com/t5/Splunk-Search/What-does-the-coalesce-command-mean-in-this-Splunk-search/m-p/239840#M71270 <P>An empty string ("") is not the same as a null value.</P> Wed, 16 Nov 2016 18:22:22 GMT https://community.splunk.com/t5/Splunk-Search/What-does-the-coalesce-command-mean-in-this-Splunk-search/m-p/239840#M71270 richgalloway 2016-11-16T18:22:22Z