https://community.splunk.com/t5/Splunk-Search/Any-difference-between-NULL-and-null-in-eval/m-p/326155#M97249 <P>In the former case, you are setting it to the value of the field named <CODE>NULL</CODE>, which in your case, clearly doesn't exist right now HOWEVER that might not always be the case. It is equivalent to <CODE>if(isnotnull(fieldX), fieldX*10, ThisFieldNameDoesNotExistSoTheValueThatItHasAlsoDoesNotExistSoRightNowThisEvaluatesToNULL)</CODE>. So it is very poor practice to use the former and you should use the latter.</P> Thu, 20 Jul 2017 22:20:18 GMT woodcock 2017-07-20T22:20:18Z https://community.splunk.com/t5/Splunk-Search/Any-difference-between-NULL-and-null-in-eval/m-p/326154#M97248 <P>In an eval expression, is there any difference between using <CODE>NULL</CODE> and <CODE>null()</CODE>?</P> <P><STRONG>Use case:</STRONG> I want to return <EM>null</EM> in an eval expression. I am finding that the following two expressions give the same result and I want to make sure that both are officially correct:</P> <UL> <LI>if (isnotnull (fieldX), fieldX * 10, NULL)</LI> <LI>if (isnotnull (fieldX), fieldX * 10, null())</LI> </UL> Thu, 20 Jul 2017 22:14:51 GMT https://community.splunk.com/t5/Splunk-Search/Any-difference-between-NULL-and-null-in-eval/m-p/326154#M97248 helge 2017-07-20T22:14:51Z https://community.splunk.com/t5/Splunk-Search/Any-difference-between-NULL-and-null-in-eval/m-p/326155#M97249 <P>In the former case, you are setting it to the value of the field named <CODE>NULL</CODE>, which in your case, clearly doesn't exist right now HOWEVER that might not always be the case. It is equivalent to <CODE>if(isnotnull(fieldX), fieldX*10, ThisFieldNameDoesNotExistSoTheValueThatItHasAlsoDoesNotExistSoRightNowThisEvaluatesToNULL)</CODE>. So it is very poor practice to use the former and you should use the latter.</P> Thu, 20 Jul 2017 22:20:18 GMT https://community.splunk.com/t5/Splunk-Search/Any-difference-between-NULL-and-null-in-eval/m-p/326155#M97249 woodcock 2017-07-20T22:20:18Z https://community.splunk.com/t5/Splunk-Search/Any-difference-between-NULL-and-null-in-eval/m-p/326156#M97250 <P>Now you mention it the answer is quite obvious <span class="lia-unicode-emoji" title=":winking_face:">😉</span><BR /> Thanks!</P> Thu, 20 Jul 2017 22:23:20 GMT https://community.splunk.com/t5/Splunk-Search/Any-difference-between-NULL-and-null-in-eval/m-p/326156#M97250 helge 2017-07-20T22:23:20Z https://community.splunk.com/t5/Splunk-Search/Any-difference-between-NULL-and-null-in-eval/m-p/326157#M97251 <P>Ah yes, The Field Who Must Not Be Named...</P> Thu, 20 Jul 2017 22:40:27 GMT https://community.splunk.com/t5/Splunk-Search/Any-difference-between-NULL-and-null-in-eval/m-p/326157#M97251 DalJeanis 2017-07-20T22:40:27Z