Splunk DB Connect 2: NULL-fields returned as 'NULL'-string, blank fields returned as actual NULL

[TheSwiney]

Hi all,

My database table has a column that seems to have both NULL and empty values in it. In TOAD it shows as:

When querying the database with DB Connect 2 | dbxquery connection=nulltest output=csv shortnames=true maxrows=0 query="select * from subscribers where username = ''" , the NULL-fields seem to have become strings, while the blank values look empty.

I could live with this if Splunk interpreted the NULL-strings as actual null-values; however, when I try to select all rows with null-values - where isnull(authentication_url) - only the rows that initially were blanks are returned.

Is there a way to avoid this behaviour? Possibly in the settings, and preferably without having to fill all field with alternative values to correct the behaviour?

[jcoates_splunk · Accepted solution]

Hi,

this will be reverted to "NULL = blank" in the next release, which is coming soon; in the meantime I'm afraid that there isn't a way to select behavior.

The intention was to behave like SQL clients which display null indications in their UI, on the assumption that it would be easy to use eval to alter the data for use, but the feedback we've gotten is that it would be better for most users not to do that.

[MaverickT]

Thanks for the information. What ETA for the next release?

[TheSwiney]

Thanks! We'll work around the issue for the time being, but happy a fix is coming soon.