Splunk Search
Highlighted

Error while creating eval expression for calculated fields in data models

Explorer

I have a data model and defined about 5 fields. But one of the fields doesnt always have a value. I want it to show as "null" when there is no value in the log. So for this particular field, I created it as a calculated field(systemid) and gave an eval expression systemid=if(isnull(systemid),"NULL",systemid). Now I get the error "Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr])."

0 Karma
Highlighted

Re: Error while creating eval expression for calculated fields in data models

SplunkTrust
SplunkTrust

What you have should work. Try this alternative, however: systemid = coalesce(systemid, "NULL").

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: Error while creating eval expression for calculated fields in data models

Explorer

Thank you for the reply @rickgalloway

I just copy pasted systemid = coalesce(systemid, "NULL") in eval expression in calculated fields and I get the same error Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr]).

Regards.

0 Karma