Splunk Enterprise

Help with if "null" command

super_saiyan
Communicator

Hi splunkers,

I want to use "null"  command in below query. If the message is "null" then it should replace with the below message otherwise it should only display the already extracted message. 

 

| eval message= if(Actor="superman","super hero", if(Actor="emma watson","model"))

Thanks.

Labels (1)
0 Karma

somesoni2
Revered Legend

Give this a try

| eval message= coalesce(message,case(Actor="superman","super hero",Actor="emma watson","model", true(),"NA"))

super_saiyan
Communicator

Thanks for your quick response @somesoni2 
could you please also provide the spl using "isnull" ?

Really appreciate your support.

0 Karma

somesoni2
Revered Legend
| eval message= if(isnotnull(message),message,case(Actor="superman","super hero",Actor="emma watson","model", true(),"NA"))
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @super_saiyan ... please check this isnull():

|makeresults | eval Actor="emma watson" 
| eval message = if(isnull(message),if(Actor="superman","super hero", if(Actor="emma watson","model", "not emma")),message) | table message

 

if-cmd.png

 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

super_saiyan
Communicator

I am getting error while using the below SPL Query

Could you please help me with that ?

super_saiyan_0-1659075047799.png

 

appreciate your help.

 

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @super_saiyan .. your "if" format was wrong.. pls check this..

|makeresults | eval Actor="emma watson" | eval message = if(isnull(message, null(),if(Actor="superman","super hero", if(Actor="emma watson","model", "not emma")) | table message

 

could you pls check this and update us with some more details:

>>> If the message is "null" then it should replace with the below message.

>>> otherwise it should only display the already extracted message. 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...