Splunk Search

Eval can not concatenate fields where there is a null value

Rob
Splunk Employee
Splunk Employee

Given that:

Field1="foo"

Field2=""

(Field2 has a null value)

and we use eval to concatenate the two

|eval Field3=Field1.Field2

or

|eval Field3=Field1+Field2

Then Field3 will contain the null value instead "foo". Instead it seems that with a null value we see it overwrite or ignore the non-null values and the whole thing just becomes a null value.

1 Solution

Rob
Splunk Employee
Splunk Employee

The workaround for this is to use

|eval Field3=if(isnotnull(Field2), Field1.Field2, Field1)

This would assume that we know that Field1 will always have a value and sometimes Field2 might only contain a null value by using the if() and isnotnull() functions of eval to test whether the field has a NULL value. If there is no NULL value then we concatenate the fields, if there is a NULL value, we simply take the first field that has a value as the value we want to keep.

View solution in original post

Rob
Splunk Employee
Splunk Employee

The workaround for this is to use

|eval Field3=if(isnotnull(Field2), Field1.Field2, Field1)

This would assume that we know that Field1 will always have a value and sometimes Field2 might only contain a null value by using the if() and isnotnull() functions of eval to test whether the field has a NULL value. If there is no NULL value then we concatenate the fields, if there is a NULL value, we simply take the first field that has a value as the value we want to keep.

Rob
Splunk Employee
Splunk Employee

Thanks for that dwaddle! I like it, its sort of temporarily replacing the null value with an empty value and concatenating for a new field.

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Hi Rob, another option is coalesce

| eval Field3=coalesce(Field1,"").coalesce(Field2,"")
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...