Splunk Search

Comparing with NULL

pm771
Communicator

Do I understand correctly that NULL is neither equal (==) nor not equal (!=) to any value? 

I know about isnull() function, but was under (apparently wrong) impression that NULL is  not equal to everything else.

Illustration:

| makeresults
| eval N=null
| eval i1=if(isnull(N), "N", "Y")
| eval i2=if(N != "Y", "N", "Y")

 

Result:

i1i2
NY

 

Is it fully documented?

 

Tags (1)

pm771
Communicator

What I meant was:

| makeresults
| eval i1=if(null==null, "true", "false")
| eval i2=if(null!=null, "true", "false")

 The return will be false and false

0 Karma

inventsekar
SplunkTrust
SplunkTrust

soo, i thought to test this with integer and string..

| makeresults
| eval N="3"
| eval i1=if(N==3, "N", "Y")
| eval i2=if(N != "3", "N", "Y")

i1=N  and i2=Y 

| makeresults
| eval N=3
| eval i1=if(N==3, "N", "Y")
| eval i2=if(N != "3", "N", "Y") 

also produced the above result. 

 

(PS - i have given around 350+ karma points so far, received badge for that,.. maybe you also should start "Learn, Give Back, Have Fun")

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk + Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...