All Apps and Add-ons

Splunk DB Connect 2: NULL-fields returned as 'NULL'-string, blank fields returned as actual NULL

TheSwiney
Engager

Hi all,

My database table has a column that seems to have both NULL and empty values in it. In TOAD it shows as:

alt text

When querying the database with DB Connect 2 | dbxquery connection=nulltest output=csv shortnames=true maxrows=0 query="select * from subscribers where username = ''" , the NULL-fields seem to have become strings, while the blank values look empty.

alt text

I could live with this if Splunk interpreted the NULL-strings as actual null-values; however, when I try to select all rows with null-values - where isnull(authentication_url) - only the rows that initially were blanks are returned.

Is there a way to avoid this behaviour? Possibly in the settings, and preferably without having to fill all field with alternative values to correct the behaviour?

0 Karma
1 Solution

jcoates_splunk
Splunk Employee
Splunk Employee

Hi,

this will be reverted to "NULL = blank" in the next release, which is coming soon; in the meantime I'm afraid that there isn't a way to select behavior.

The intention was to behave like SQL clients which display null indications in their UI, on the assumption that it would be easy to use eval to alter the data for use, but the feedback we've gotten is that it would be better for most users not to do that.

View solution in original post

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

Hi,

this will be reverted to "NULL = blank" in the next release, which is coming soon; in the meantime I'm afraid that there isn't a way to select behavior.

The intention was to behave like SQL clients which display null indications in their UI, on the assumption that it would be easy to use eval to alter the data for use, but the feedback we've gotten is that it would be better for most users not to do that.

View solution in original post

0 Karma

MaverickT
Communicator

Thanks for the information. What ETA for the next release?

0 Karma

TheSwiney
Engager

Thanks! We'll work around the issue for the time being, but happy a fix is coming soon.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!