https://community.splunk.com/t5/Splunk-Search/How-to-treat-nulls-as-zeros-for-purpose-of-adding/m-p/41390#M9597 <P>Coalesce is woefully underutilized and a great suggestion. However, as you have it here, it will produce a significantly different result than what the if(isnull()) commands I posted above will do, and significantly different than what atornes was looking for. Again though, props for remembering coalesce.</P> <P>If you really want to use coalesce in this situation you would need:</P> <P>| eval field1=coalesce(field1, 0) | eval field2=coalesce(field2, 0) |</P> Wed, 28 Dec 2011 18:18:30 GMT rtadams89 2011-12-28T18:18:30Z https://community.splunk.com/t5/Splunk-Search/How-to-treat-nulls-as-zeros-for-purpose-of-adding/m-p/41385#M9592 <P>I'm trying to add 2 fields, each of which contains some nulls. How can I treat these nulls as zeros for the purpose off adding? When doing so as is, it the 2 values added together have returned null.</P> <P>There are no good examples of how to use the if() operator and the ifnull() operator has no documentation at all. I'd imagine these are the best methods for achieving this. Any help would be appreciated</P> Wed, 28 Dec 2011 15:56:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-treat-nulls-as-zeros-for-purpose-of-adding/m-p/41385#M9592 atornes 2011-12-28T15:56:33Z https://community.splunk.com/t5/Splunk-Search/How-to-treat-nulls-as-zeros-for-purpose-of-adding/m-p/41386#M9593 <P>Try this in the query --&gt; fillnull value=0</P> Wed, 28 Dec 2011 17:24:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-treat-nulls-as-zeros-for-purpose-of-adding/m-p/41386#M9593 Ravan 2011-12-28T17:24:39Z https://community.splunk.com/t5/Splunk-Search/How-to-treat-nulls-as-zeros-for-purpose-of-adding/m-p/41387#M9594 <P>If you have two fields ("field1" and "field2"), you could put this in your search query before the addition is performed:</P> <PRE><CODE>| eval field1=if(isnull(field1), 0, field1 | eval field2=if(isnull(field2), 0, field2) | </CODE></PRE> <P>There are slightly more compact ways to do the same thing, but the above should perform fine and will keep your search string easy to read.</P> Wed, 28 Dec 2011 17:27:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-treat-nulls-as-zeros-for-purpose-of-adding/m-p/41387#M9594 rtadams89 2011-12-28T17:27:27Z https://community.splunk.com/t5/Splunk-Search/How-to-treat-nulls-as-zeros-for-purpose-of-adding/m-p/41388#M9595 <P>This is one of the more compact ways to do it. I would include the optional field parameters too, as you don't want to accidentaly set some fields equal to zero that should remain null. Also, it should default to "0", so the "value" parameter is optional.</P> <P>| fillnull field1 field2 |</P> Wed, 28 Dec 2011 17:32:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-treat-nulls-as-zeros-for-purpose-of-adding/m-p/41388#M9595 rtadams89 2011-12-28T17:32:04Z https://community.splunk.com/t5/Splunk-Search/How-to-treat-nulls-as-zeros-for-purpose-of-adding/m-p/41389#M9596 <P>The <CODE>eval</CODE> command <CODE>coalesce</CODE> is also useful for this purpose. <CODE>coalesce</CODE> will return the first non-null value from its set of arguments - using it is frequently easier than cascading <CODE>if</CODE> statements.</P> <PRE><CODE>| eval xyz=coalesce(field1,field2,field3,0) </CODE></PRE> Wed, 28 Dec 2011 18:11:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-treat-nulls-as-zeros-for-purpose-of-adding/m-p/41389#M9596 dwaddle 2011-12-28T18:11:40Z https://community.splunk.com/t5/Splunk-Search/How-to-treat-nulls-as-zeros-for-purpose-of-adding/m-p/41390#M9597 <P>Coalesce is woefully underutilized and a great suggestion. However, as you have it here, it will produce a significantly different result than what the if(isnull()) commands I posted above will do, and significantly different than what atornes was looking for. Again though, props for remembering coalesce.</P> <P>If you really want to use coalesce in this situation you would need:</P> <P>| eval field1=coalesce(field1, 0) | eval field2=coalesce(field2, 0) |</P> Wed, 28 Dec 2011 18:18:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-treat-nulls-as-zeros-for-purpose-of-adding/m-p/41390#M9597 rtadams89 2011-12-28T18:18:30Z