https://community.splunk.com/t5/Splunk-Search/what-does-the-coalesce-and-eval-in-my-query-do/m-p/300795#M90563 <P>Could anyone explain what does the below search string means ?</P> <P>| eval fieldA=coalesce(abc, "def")</P> Thu, 18 May 2017 19:38:21 GMT pavanae 2017-05-18T19:38:21Z https://community.splunk.com/t5/Splunk-Search/what-does-the-coalesce-and-eval-in-my-query-do/m-p/300795#M90563 <P>Could anyone explain what does the below search string means ?</P> <P>| eval fieldA=coalesce(abc, "def")</P> Thu, 18 May 2017 19:38:21 GMT https://community.splunk.com/t5/Splunk-Search/what-does-the-coalesce-and-eval-in-my-query-do/m-p/300795#M90563 pavanae 2017-05-18T19:38:21Z https://community.splunk.com/t5/Splunk-Search/what-does-the-coalesce-and-eval-in-my-query-do/m-p/300796#M90564 <P>it would create a field called <STRONG>fieldA</STRONG> and if there was a value in field <STRONG>abc</STRONG> it would use that value, otherwise it would fill in <STRONG>def</STRONG></P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/ConditionalFunctions#coalesce.28X.2C....29">http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/ConditionalFunctions#coalesce.28X.2C....29</A></P> Thu, 18 May 2017 20:13:55 GMT https://community.splunk.com/t5/Splunk-Search/what-does-the-coalesce-and-eval-in-my-query-do/m-p/300796#M90564 cmerriman 2017-05-18T20:13:55Z https://community.splunk.com/t5/Splunk-Search/what-does-the-coalesce-and-eval-in-my-query-do/m-p/300797#M90565 <P>The verb <CODE>eval</CODE> is similar to the way that the word <CODE>set</CODE> is used in java or c. It flags to splunk that it is supposed to calculate whatever is to the right of the equals sign and assign that value to the variable on the left side of the equals sign.</P> <P>The verb <CODE>coalesce</CODE> indicates that the first non-null value is to be used. In this case, it is equivalent to either of the following lines...</P> <PRE><CODE>| eval fieldA=if(isnotnull(abc),abc,"def") | eval fieldA=if(isnull(abc),"def",abc) </CODE></PRE> <P>when there are only two values, <CODE>coalesce</CODE> is not much better than the <CODE>if-isnull</CODE>, but at three values, the usefulness of <CODE>coalesce</CODE> becomes obvious, and at four, using anything else is ridiculous.</P> <P>The following are equivalent for three items...</P> <PRE><CODE>| eval fieldA=coalesce(fieldA,fieldB,fieldC) | eval fieldA=if(isnotnull(fieldA),fieldA,if(isnotnull(fieldB),fieldB,fieldC)) | eval fieldA=if(isnull(fieldA),if(isnull(fieldB),fieldC,fieldB),fieldA) </CODE></PRE> <P>The following are equivalent for four items...</P> <PRE><CODE>| eval fieldA=coalesce(fieldA,fieldB,fieldC,fieldD) | eval fieldA=if(isnotnull(fieldA),fieldA,if(isnotnull(fieldB),fieldB,if(isnotnull(fieldC),fieldC,fieldD))) | eval fieldA=if(isnull(fieldA),if(isnull(fieldB),if(isnull(fieldC),fieldC,fieldD),fieldB),fieldA) </CODE></PRE> <P>... and so on...</P> Thu, 18 May 2017 20:14:50 GMT https://community.splunk.com/t5/Splunk-Search/what-does-the-coalesce-and-eval-in-my-query-do/m-p/300797#M90565 DalJeanis 2017-05-18T20:14:50Z https://community.splunk.com/t5/Splunk-Search/what-does-the-coalesce-and-eval-in-my-query-do/m-p/300798#M90566 <P>Returns the value of abc if it is not null, otherwise defaults to "def" if abc field value is null. You can do the same with if() and case() using isnull() or isnotnull() functions on the field abc.</P> <PRE><CODE> | eval fieldA= if(isnull(abc),"def",abc) </CODE></PRE> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ConditionalFunctions">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ConditionalFunctions</A></P> Thu, 18 May 2017 20:17:25 GMT https://community.splunk.com/t5/Splunk-Search/what-does-the-coalesce-and-eval-in-my-query-do/m-p/300798#M90566 niketn 2017-05-18T20:17:25Z