- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Comparing with NULL

pm771
Communicator
09-24-2020
06:24 PM
Do I understand correctly that NULL is neither equal (==) nor not equal (!=) to any value?
I know about isnull() function, but was under (apparently wrong) impression that NULL is not equal to everything else.
Illustration:
| makeresults
| eval N=null
| eval i1=if(isnull(N), "N", "Y")
| eval i2=if(N != "Y", "N", "Y")
Result:
i1 | i2 |
N | Y |
Is it fully documented?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

pm771
Communicator
09-24-2020
06:54 PM
What I meant was:
| makeresults
| eval i1=if(null==null, "true", "false")
| eval i2=if(null!=null, "true", "false")
The return will be false and false.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
inventsekar

SplunkTrust
09-24-2020
06:42 PM
soo, i thought to test this with integer and string..
| makeresults
| eval N="3"
| eval i1=if(N==3, "N", "Y")
| eval i2=if(N != "3", "N", "Y")
i1=N and i2=Y
| makeresults
| eval N=3
| eval i1=if(N==3, "N", "Y")
| eval i2=if(N != "3", "N", "Y")
also produced the above result.
(PS - i have given around 350+ karma points so far, received badge for that,.. maybe you also should start "Learn, Give Back, Have Fun")
thanks and best regards,
Sekar
PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
Sekar
PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
