All Apps and Add-ons

Splunk DB Connect 2: NULL-fields returned as 'NULL'-string, blank fields returned as actual NULL

TheSwiney
Engager

Hi all,

My database table has a column that seems to have both NULL and empty values in it. In TOAD it shows as:

alt text

When querying the database with DB Connect 2 | dbxquery connection=nulltest output=csv shortnames=true maxrows=0 query="select * from subscribers where username = ''" , the NULL-fields seem to have become strings, while the blank values look empty.

alt text

I could live with this if Splunk interpreted the NULL-strings as actual null-values; however, when I try to select all rows with null-values - where isnull(authentication_url) - only the rows that initially were blanks are returned.

Is there a way to avoid this behaviour? Possibly in the settings, and preferably without having to fill all field with alternative values to correct the behaviour?

0 Karma
1 Solution

jcoates_splunk
Splunk Employee
Splunk Employee

Hi,

this will be reverted to "NULL = blank" in the next release, which is coming soon; in the meantime I'm afraid that there isn't a way to select behavior.

The intention was to behave like SQL clients which display null indications in their UI, on the assumption that it would be easy to use eval to alter the data for use, but the feedback we've gotten is that it would be better for most users not to do that.

View solution in original post

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

Hi,

this will be reverted to "NULL = blank" in the next release, which is coming soon; in the meantime I'm afraid that there isn't a way to select behavior.

The intention was to behave like SQL clients which display null indications in their UI, on the assumption that it would be easy to use eval to alter the data for use, but the feedback we've gotten is that it would be better for most users not to do that.

0 Karma

MaverickT
Communicator

Thanks for the information. What ETA for the next release?

0 Karma

TheSwiney
Engager

Thanks! We'll work around the issue for the time being, but happy a fix is coming soon.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...