How to force DBconnect to send fields with NULL values to the index?

[rajacybermak]

DBconnect is not sending fields with NULL values to the index
Is there a way to force DBconnect to do this ?

[rajacybermak]

I have used query as below in DBconnect
SELECT COALESCE(field1,'NULL') AS field1, field2 FROM "schema1"."table1"
and getting the desired results

[rajacybermak]

Thank You Rich
The major problem is , most of the time, making changes to the DB side is near impossible !

Thanks
Raja

[Richfez]

The easiest way to fix this is on the DB side of things, not the Splunk side. If you handle null values there and convert them into just an empty string, they'll come across into Splunk fine.

So how to do that? Well, you don't mention which DBMS you are using so you'll have to look up your own, but most DBs have some variant of COALESCE which will just take fields or values until one is not null. So, ON THE QUERY side of things that SometimesNullField would be selected out using a SQL statement vaguely like this one...

select field1, field2, COALESCE(SometimesNullField, "") AS SomettimeNullFieldFixed, field4, .... FROM ....

Though another option would be to use that same sort of syntax (Whatever it is for your DBMS) to create a View, then have Splunk call the view instead of the raw table (this is also useful for abstracting complex queries into a simple and easy to read one that Splunk uses, and pushes Business logic into the DB layer).

Lastly, you could also get around this whole entire problem by not ever allowing null values in your database. Again, a problem that needs fixing on the DB side of things.

I hope these help!
H
appy Splunking,
Rich