All Apps and Add-ons

Does Splunk have a NVL-like function or feature?

suhprano
Path Finder

Is it possible to return a 0 or -1 for null subsearch matches in splunk?

sourcetype=log1 [search sourcetype=log2|fields id|dedup id]|fields id,status |sort id

This gives me all id and status entries from log1 that match all the ids in log2, but if there are no log2 ids matching in log1, is it possible to report/create a dummy entry with a default value in the result set?

Tags (2)
1 Solution

Ayn
Legend

There is indeed a NVL equivalent in the Splunk search language. It is called fillnull. More information on that command is available here: http://www.splunk.com/base/Documentation/latest/SearchReference/Fillnull

View solution in original post

jamesdaily
Explorer

COALESCE is the ANSI standard SQL function equivalent to Oracle NVL. Unlike NVL, COALESCE supports more than two fields in the list.

In Splunk, coalesce() returns the value of the first non-null field in the list.

Here's an example where you'd get the Preferred_Name if it's present, otherwise use the First_name if it's present, and if both of those are null, then just use the word "Friend". If you didn't include a default at the end, and both fields were blank, you'd just get a blank.

eval name_to_use=coalesce(preferred_name,first_name,"Friend")| table name_to_use

0 Karma

Ayn
Legend

There is indeed a NVL equivalent in the Splunk search language. It is called fillnull. More information on that command is available here: http://www.splunk.com/base/Documentation/latest/SearchReference/Fillnull

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...