All Apps and Add-ons

Splunk DB Connect 2: NULL-fields returned as 'NULL'-string, blank fields returned as actual NULL

TheSwiney
Engager

Hi all,

My database table has a column that seems to have both NULL and empty values in it. In TOAD it shows as:

alt text

When querying the database with DB Connect 2 | dbxquery connection=nulltest output=csv shortnames=true maxrows=0 query="select * from subscribers where username = ''" , the NULL-fields seem to have become strings, while the blank values look empty.

alt text

I could live with this if Splunk interpreted the NULL-strings as actual null-values; however, when I try to select all rows with null-values - where isnull(authentication_url) - only the rows that initially were blanks are returned.

Is there a way to avoid this behaviour? Possibly in the settings, and preferably without having to fill all field with alternative values to correct the behaviour?

0 Karma
1 Solution

jcoates_splunk
Splunk Employee
Splunk Employee

Hi,

this will be reverted to "NULL = blank" in the next release, which is coming soon; in the meantime I'm afraid that there isn't a way to select behavior.

The intention was to behave like SQL clients which display null indications in their UI, on the assumption that it would be easy to use eval to alter the data for use, but the feedback we've gotten is that it would be better for most users not to do that.

View solution in original post

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

Hi,

this will be reverted to "NULL = blank" in the next release, which is coming soon; in the meantime I'm afraid that there isn't a way to select behavior.

The intention was to behave like SQL clients which display null indications in their UI, on the assumption that it would be easy to use eval to alter the data for use, but the feedback we've gotten is that it would be better for most users not to do that.

0 Karma

MaverickT
Communicator

Thanks for the information. What ETA for the next release?

0 Karma

TheSwiney
Engager

Thanks! We'll work around the issue for the time being, but happy a fix is coming soon.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...